Middleware for logging request/responses in Express apps
- Logging request
- Logging response
- Mask request body fields
- Exclude request body fields
- Exclude request specific headers
- Mask response body fields
- Exclude response body fields
- Exclude response specific headers
- Exclude specific URLs from logging
- Supported by Node v8 and above.
This is a Node.js module available through the
npm registry. Installation is done using the
npm install command:
$ npm install express-requests-loggervar audit = require('express-requests-logger')Create an audit middleware with ther given options.
the express-requests-logger accepts the following properties in the options object.
The logger to use for logging the request/response.
Package tested only with bunyan logger, but should work with any logger which has a info method which takes an object.
Should be a function, that returns boolean value to indicate whether to skip the audit for the current request. Usually the logic should be around the request/response params. Useful to provide a custom logic for cases we would want to skip logging specific request.
The default implementation of the function returns false.
Example, skipping logging of all success responses:
shouldSkipAuditFunc: function(req, res){
let shouldSkip = false;
if (res.statusCode === 200){
// _bodyJson is added by this package
if (res._bodyJson.result === "success"){
shouldSkip = true;
}
}
return shouldSkip;
}true - log once the request arrives (request details), and log after response is sent (both request and response). - Useful if there is a concern that the server will crash during the request and there is a need to log the request before it's processed.
false - log only after the response is sent.
Array of strings - if the request url matches one of the values in the array, the request/response won't be logged.
For example: if there is a path /v1/health that we do not want to log, add:
excludeURLs: ['health']Specific configuration for requests
Boolean - true - include request in audit, false - don't.
Array of strings - pass the fields you wish to exclude in the body of the requests (sensitive data like passwords, credit cards numbers etc..).
* field - exclude all body
Array of strings - pass the fields you wish to mask in the body of the requests (sensitive data like passwords, credit cards numbers etc..).
Array of strings - pass the fields you wish to mask in the query of the requests (sensitive data like passwords, credit cards numbers etc..).
Array of strings - pass the header names you wish to exclude from the audit (senstitive data like authorization headers etc..).
* field - exclude all headers
Array of strings - pass the fields you wish to mask in the headers of the requests (senstitive data like authorization headers etc..).
Restrict request body's logged content length (inputs other than positive integers will be ignored).
Additional to mask options, you can add your own functionality to mask request body. This function will execute as a masking function before the package functions. The custom function gets the full express request and should return the masked body.
Specific configuration for responses
Doesn't print headers for Node below v6.9.2
Non JSON responses are not masked, and are logged as is. This is deducted from the response header content-type
Boolean - true - include response in audit, false - don't.
Array of strings - pass the fields you wish to exclude in the body of the responses (sensitive data like passwords, credit cards numbers etc..).
* field - exclude all body
Array of strings - pass the fields you wish to mask in the body of the responses (sensitive data like passwords, credit cards numbers etc..).
Array of strings - pass the header names you wish to exclude from the audit (senstitive data like authorization headers etc..).
* field - exclude all headers
Array of strings - pass the fields you wish to mask in the headers of the responses (senstitive data like authorization headers etc..).
Map of statusCodes to log levels. By default the audit is logged with level 'info'. It is possible to override it by configuration according to the statusCode of the response:
- Key: status code, or status code group: '2xx', '401', etc.. First we try to match by exact match (for example 400), if no key found by exact match we fallback to match bu group (4xx).
- Value: log level, valid values: 'trace', 'debug', 'info', 'warn', 'error'.
- Configuration errors are ignored and the log is info by default.
Restrict response body's logged content length (inputs other than positive integers will be ignored).
Example:
levels: {
"2xx":"info", // All 2xx responses are info
"401":"warn", // 401 are warn
"4xx':info", // All 4xx except 401 are info
"503":"warn",
"5xx":"error" // All 5xx except 503 are errors, 503 is warn,
}
app.use(audit({
logger: logger, // Existing bunyan logger
excludeURLs: [‘health’, ‘metrics’], // Exclude paths which enclude 'health' & 'metrics'
request: {
maskBody: [‘password’], // Mask 'password' field in incoming requests
excludeHeaders: [‘authorization’], // Exclude 'authorization' header from requests
excludeBody: [‘creditCard’], // Exclude 'creditCard' field from requests body
maskHeaders: [‘header1’], // Mask 'header1' header in incoming requests
maxBodyLength: 50 // limit length to 50 chars + '...'
},
response: {
maskBody: [‘session_token’] // Mask 'session_token' field in response body
excludeHeaders: [‘*’], // Exclude all headers from responses,
excludeBody: [‘*’], // Exclude all body from responses
maskHeaders: [‘header1’], // Mask 'header1' header in incoming requests
maxBodyLength: 50 // limit length to 50 chars + '...'
},
shouldSkipAuditFunc: function(req, res){
// Custom logic here.. i.e: return res.statusCode === 200
return false;
}
}));