How do I keep passwords, tokens and personal data out of LogRocket recordings?

By Ohad Krispin, founder of VibeRaven · LinkedIn

LogRocket does not record input elements of type password, but its docs say all other elements are captured by default, and requests made with XMLHttpRequest and fetch are captured with status codes, headers and bodies. Mark other fields with the data-private attribute, or set dom.inputSanitizer and dom.textSanitizer to true in LogRocket.init to obscure all inputs and text. The network is a separate path: add network.requestSanitizer and network.responseSanitizer that blank headers such as Authorization and Cookie and the bodies of sign-in requests, or return null to drop a request. LogRocket says excluded data never reaches its servers, so redact in the browser before the data leaves it.

Does LogRocket record password fields and other inputs?

Password inputs are not recorded. Everything else is captured unless you exclude it. An element with the data-private attribute is sanitized, and so are its children; for inputs the default redaction type is redact, and lipsum replays Lorem Ipsum instead of the real characters. The two global options, inputSanitizer and textSanitizer, both default to false. With them on, the docs say nodes can be allowlisted with data-public. redactSelectors redacts matching elements including user input on them, and hideSelectors leaves them out of the replay.

LogRocket.init("YOUR_APP_ID", {
  dom: {
    inputSanitizer: true,
    textSanitizer: true,
    redactSelectors: [".account-email", "#billing-address"],
    hideSelectors: [".api-key-panel"],
  },
});

How do I keep Authorization headers and request bodies out of LogRocket?

The web docs show examples that edit the request object and return it: set a header to an empty string, set body to null, or return null from requestSanitizer to ignore the whole request and response pair. Returning null from responseSanitizer redacts all response fields and records only timing. The docs examples blank one header, x-auth-token, so list every header and path your app uses for tokens. The code below checks header names without regard to case.

LogRocket.init("YOUR_APP_ID", {
  network: {
    requestSanitizer: (request) => {
      if (request.url.toLowerCase().includes("/auth/")) {
        return null;
      }
      for (const name of Object.keys(request.headers)) {
        if (["authorization", "cookie"].includes(name.toLowerCase())) {
          request.headers[name] = "";
        }
      }
      return request;
    },
    responseSanitizer: (response) => {
      response.body = null;
      return response;
    },
  },
});

What else ends up in a LogRocket session?

Console logs are captured automatically, so a token you print while debugging is recorded. Redux actions and state are captured too, and the package has stateSanitizer and actionSanitizer options for them. identify(uid, traits) attaches the traits you pass, so leave out data you do not need. The package types also declare browser.urlSanitizer, which takes a URL and returns a string or null, and shouldCaptureIP, which controls IP collection. Check LogRocket's reference before you rely on either.

Checklist

How to fix it, then check the fix

List the places that handle secrets or personal data: password forms, token headers, identify calls:

grep -rnE "Authorization|access_token|refresh_token|password|LogRocket.identify" --exclude-dir=node_modules --exclude-dir=.next --exclude-dir=dist .

02Add data-private to every field or panel that shows personal data, including a password field that a show-password toggle can switch to plain text, and consider inputSanitizer and textSanitizer set to true with data-public on the few nodes you want visible.
03Add requestSanitizer and responseSanitizer under network in LogRocket.init that blank token headers, drop sign-in and token requests, and remove bodies that carry personal data.
04Remove console.log calls that print tokens or user records, and pass only the identify traits you need.
05Deploy, record a fresh session, and open its replay in LogRocket: check the sign-in form, the account page and the Network entries for those requests. An old session was recorded before the change, so do not use it.

Sources

Official docs behind this checklist

Browse all launch guides · Read resources · How to make and check your next change

FAQ

FAQ for builders before launch

Is a password field ever recorded?

LogRocket's DOM reference says the SDK will not record input elements where type is password. The rule is stated for that type, so add data-private to any field that holds a secret under another type.

Should I turn network capture off instead?

The package has a network.isEnabled option, so you can. LogRocket's React Native network page recommends sanitizing headers and bodies instead, so that failed network requests are still detected; the web page does not say this, so check a test session before you rely on it.

Can I mask everything and show only what I allow?

Yes for the page content: with inputSanitizer or textSanitizer on, the docs say nodes can be allowlisted with the data-public attribute. Network data has no such switch in the docs, so keep the sanitizers above.