title: Parameter filter for password not working (Ruby on Rails)
body: <p>I am creating a logging method in my application controller.  I have the following setup, but for some reason, my parameter filter is not filtering the password.  What is missing? How do I make sure my app is secure and that all the password parameters are being filtered?</p>
  
  <p><em><strong>config/applicaton.rb</em></strong></p>
  
  <pre><code>  # Configure sensitive parameters which will be filtered from the log file.
    config.filter_parameters += [:password]
  </code></pre>
  
  <p><em><strong>applicaton controller</em></strong></p>
  
  <pre><code>  before_filter :record_activity
  
    def record_activity(note = nil)
        @activity={}
        @activity['user'] = current_user
        @activity['note'] = note
        @activity['browser'] = request.env['HTTP_USER_AGENT']
        @activity['ip_address'] = request.env['REMOTE_ADDR']
        @activity['controller'] = controller_name 
        @activity['action'] = action_name 
        @activity['params'] = log_filter(params.inspect)
        p @activity
    end
  </code></pre>
  
  <p><em><strong>OUTPUT IN TERMINAL</em></strong></p>
  
  <pre><code>    15:39:38 web.1    | 
  {"user"=&gt;nil, 
  "note"=&gt;nil, 
  "browser"=&gt;"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:20.0) Gecko/20100101 Firefox/20.0",
   "ip_address"=&gt;"127.0.0.1", 
  "controller"=&gt;"sessions", 
  "action"=&gt;"create", 
  "params"=&gt;"{\"utf8\"=&gt;\"✓\", \"authenticity_token\"=&gt;\"dYofOQ64sTajNVn2JiJWVM+E3kz5jCGazrYBObukBAQ=\", 
  \"user\"=&gt;{\"email\"=&gt;\"user@domain.com\",
   \"password\"=&gt;\"thepasswordexposed\",
   \"remember_me\"=&gt;\"0\"}, 
  \"commit\"=&gt;\"Login\", 
  \"action\"=&gt;\"create\", 
  \"controller\"=&gt;\"sessions\"}"}
  </code></pre>
  
  <p>*<strong>EDIT: *</strong>
  I've added the following, but it still does not work, any recommendation?</p>
  
  <pre><code>  def log_filter(hash)
      filters = Rails.application.config.filter_parameters
      f = ActionDispatch::Http::ParameterFilter.new filters
      f.filter hash
    end
  </code></pre>
  
  <p><em><strong>Error on line 36 ...</em></strong></p>
  
  <pre><code>NoMethodError at /users/sign_in    
  undefined method `each' for #&lt;String:0x007fa0280b3a68&gt;
  
  36     f.filter hash
  </code></pre>
  
  <p>ANSWER:</p>
  
  <p>My solution was as follows, I needed to remove the .inspect and it started working.</p>
  
  <pre><code>  def record_activity(note = nil)
        @activity={}
        @activity['user'] = current_user
        @activity['note'] = note
        @activity['browser'] = request.env['HTTP_USER_AGENT']
        @activity['ip_address'] = request.env['REMOTE_ADDR']
        @activity['controller'] = controller_name 
        @activity['action'] = action_name 
        @activity['params'] = params
        p @activity
    end
  </code></pre>