Merge pull request #1053 from maykinmedia/fix/2130-axes-hide-incorrec…

…t-password

🔒 [#2130] Obfuscate incorrect password in Axes logs

src/open_inwoner/conf/base.py

@@ -630,6 +630,9 @@
 AXES_USE_USER_AGENT = True  # Default: False
 AXES_LOCK_OUT_BY_COMBINATION_USER_AND_IP = True  # Default: False
 AXES_BEHIND_REVERSE_PROXY = IS_HTTPS
+# By default, Axes obfuscates values for formfields named "password", but the admin
+# interface login formfield name is "auth-password", so we obfuscate that as well
+AXES_SENSITIVE_PARAMETERS = ["password", "auth-password"]  # nosec
 
 # The default meta precedence order
 IPWARE_META_PRECEDENCE_ORDER = (