A Request/Response Logger That Does Not Leak Secrets

// Redact-by-key middleware for HTTP request/response logging.
// Tested with `npx tsx`. No deps.

type Json = string | number | boolean | null | Json[] | { [k: string]: Json };

const REDACT_KEYS = new Set([
    'authorization', 'cookie', 'set-cookie',
    'password', 'token', 'access_token', 'refresh_token',
    'api_key', 'apikey', 'x-api-key',
    'card', 'cvc', 'pan', 'ssn',
]);
const REDACT_PATTERNS: RegExp[] = [
    /\b\d{13,19}\b/,                    // card-like numbers
    /eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+/, // JWTs
    /sk_(?:test|live)_[A-Za-z0-9]{16,}/,                     // Stripe secret keys
];

function redact(value: Json, parentKey = ''): Json {
    if (typeof value === 'string') {
        if (REDACT_KEYS.has(parentKey.toLowerCase())) return '[REDACTED]';
        let s = value;
        for (const re of REDACT_PATTERNS) {
            s = s.replace(re, '[REDACTED]');
        }
        return s;
    }
    if (Array.isArray(value)) return value.map((v) => redact(v));
    if (value && typeof value === 'object') {
        const out: { [k: string]: Json } = {};
        for (const [k, v] of Object.entries(value)) {
            out[k] = REDACT_KEYS.has(k.toLowerCase()) ? '[REDACTED]' : redact(v, k);
        }
        return out;
    }
    return value;
}

const sample: Json = {
    headers: { authorization: 'Bearer eyJhbGciOiJIUzI1NiJ9.payload.sig', 'x-trace-id': 'abc' },
    body: { user: 'me', card: '4242424242424242', note: 'My key is sk_test_AbCdEfGhIjKlMnOpQrSt12' },
};
console.log(JSON.stringify(redact(sample), null, 2));

// Express-style middleware that logs request + response with redaction.
// Mock req/res shapes here so the file runs standalone.

type Json = string | number | boolean | null | Json[] | { [k: string]: Json };
const REDACT_KEYS = new Set(['authorization', 'cookie', 'password', 'token']);

function redact(value: Json, parentKey = ''): Json {
    if (typeof value === 'string') {
        return REDACT_KEYS.has(parentKey.toLowerCase()) ? '[REDACTED]' : value;
    }
    if (Array.isArray(value)) return value.map((v) => redact(v));
    if (value && typeof value === 'object') {
        const out: { [k: string]: Json } = {};
        for (const [k, v] of Object.entries(value)) {
            out[k] = REDACT_KEYS.has(k.toLowerCase()) ? '[REDACTED]' : redact(v, k);
        }
        return out;
    }
    return value;
}

interface Req { method: string; path: string; headers: Record<string, string>; body: Json; }
interface Res { statusCode: number; body: Json; }

function logExchange(req: Req, res: Res, durationMs: number) {
    const record = {
        ts: new Date().toISOString(),
        req: { method: req.method, path: req.path, headers: redact(req.headers), body: redact(req.body) },
        res: { status: res.statusCode, body: redact(res.body) },
        durationMs,
    };
    console.log(JSON.stringify(record));
}

logExchange(
    { method: 'POST', path: '/login', headers: { authorization: 'Bearer s3cret' }, body: { email: '[email protected]', password: 'hunter2' } },
    { statusCode: 200, body: { token: 'jwt.value.here', userId: 42 } },
    37,
);

// Body sampling for high-volume endpoints. Logs full body 1-in-N times,
// always logs on non-2xx, and tags every record with a stable correlation id.

let counter = 0;
const SAMPLE_RATE = 100; // log full body every 100 requests
let recentErrors = 0;

interface Req { method: string; path: string; bodyBytes: number; }
interface Res { statusCode: number; bodyBytes: number; }

function shouldKeepBody(res: Res): boolean {
    counter++;
    if (res.statusCode >= 400) return true;          // always on errors
    return counter % SAMPLE_RATE === 0;              // sample success cases
}

function correlationId(): string {
    return Math.random().toString(36).slice(2, 10);
}

function logSampled(req: Req, res: Res, sampledBody: { req: unknown; res: unknown } | null) {
    const record = {
        cid: correlationId(),
        method: req.method,
        path: req.path,
        status: res.statusCode,
        reqBytes: req.bodyBytes,
        resBytes: res.bodyBytes,
        sampled: sampledBody !== null,
        ...(sampledBody ?? {}),
    };
    if (res.statusCode >= 400) recentErrors++;
    console.log(JSON.stringify(record));
}

// Simulate 5 traffic events.
for (let i = 0; i < 5; i++) {
    const req = { method: 'POST', path: '/checkout', bodyBytes: 1200 };
    const res = { statusCode: i === 3 ? 500 : 200, bodyBytes: 64 };
    const keep = shouldKeepBody(res);
    logSampled(req, res, keep ? { reqBody: '<…redacted body…>', resBody: '<…redacted body…>' } : null);
}
console.log('errors-this-batch:', recentErrors);