Can we add filter the req object generated by pinoLogger on express. Like it shows cookie in req object before its logged into the file using ddStream

Question

import pinoMulti from 'pino-multi-stream';

const { NODE_ENV, DD_API_KEY, LOGGER_TYPE } = process.env;

const ddStream = {
  stream: ddTransport.createWriteStreamSync({
    //TODO: Investigate better "tags!"
    apiKey: `${DD_API_KEY}`,
    size: 1,
    service: NODE_ENV === 'production' ? 'dev-aws-auth' : 'dev-local-auth',
    ddsource: NODE_ENV === 'production' ? 'dev-aws' : 'dev-local',
  }),
};

const prettyStdOut = { stream: pinoMulti.prettyStream({
  colorize: true,
  stream: process.stdout,
})};

export const myLogger =
  LOGGER_TYPE === 'production'
    ? pinoMulti({ streams: [ddStream] })
    : pinoMulti({ streams: [ddStream, prettyStdOut] });

Can we add filter the req object generated by pinoLogger on express? Like it shows cookie in req object before its logged into the file using ddStream

SampleLogs Attaching sample logs from the above code. can cookie be filtered out from req object, or before we store the logs in to the file

    res: {
      "statusCode": 200,
      "headers": {
        "accept-ranges": "bytes",
        "cache-control": "public, max-age=0",
        "last-modified": "Thu, 24 Sep 2020 21:36:03 GMT",
        "content-type": "text/html; charset=UTF-8",
        "content-length": 28
      }
    }
    responseTime: 15
    logger: "customLog"
    req: {
      "id": 1,
      "method": "GET",
      "url": "/",
      "headers": {
        "host": "localhost:8000",
        "accept": "text/html,application/xhtml+xml,application/xml",
        "**cookie**": "connect.sid=xxxxx.yyyyy",
        "accept-language": "en-us",
        "accept-encoding": "gzip, deflate",
        "connection": "keep-alive"
      },
      "remoteAddress": "
    }

Answer 1

Hiding header in req and response on express app which was generating secret info in loggers. Add a statement on express app object itself

  const app = express();
  app.use(function(req, res, next) {
  delete req.headers['cookie']; // should be lowercase
  delete req.headers['set-cookie'];
  next();
});

.use(session({
        secret: 'xxx',
        resave: false,
        saveUninitialized: false}))//the session cookie will not be set on the browser unless the session is modified