Default handlers log too much and there's no way to disable them through the library API

I’m trying to use backoff with a login function that connects to an external server. The code looks something like this.

@backoff.on_exception(backoff.expo, FailedConnection)
def login(username, password):
    # stuff

When on_backoff triggers, the default handler is invoked which logs the signature which includes the password in this case.

It’d be great to have a way to disable/override the default handlers to provide my own logging behavior.

[bgreen-litl]

@duckpunch sorry merging this got delayed because I was trying to work out the best way to accommodate the competing goal of making the original behavior available in a convenient way via the API. That said, I’m actually inclined to merge this and release it as is as backoff==1.3.2 since I consider this potential for unwanted information leakage to be a security issue.

@luckydonald I have a WIP for supporting the original logging behavior out of the box via the API, but it involves some subtle changes in the contract of the event handler callbacks. As such, I’d probably end up releasing it as 1.4 but I’m not quite ready for that. In the meantime, you can either use the user-space implementation I suggested above, or freeze backoff at 1.3.1.

[bgreen-litl]

Created related issue https://github.com/litl/backoff/issues/21