option to disable headers about pino-http

[sethtomy]

For those coming to this as I did, please be aware that the serializer will mutate the incoming request.

If your intention is to only remove from the logs:

export const httpLogger = pinoHttp({
  logger,
  redact: {
      paths: 'req.headers.authorization',
    }
  },
})

[jtokoph]

Note that something like delete r.headers['cookie'] will remove the cookie from the request. It's generally safer to have the serializer return a new object for a couple reasons:

• A pure function that doesn't mutate it's input is more likely to be safe and correct.
• Redacting/blocklists will almost always result in leaked data. For example, you might redact the cookie header, but a user of your API might attempt to set the Authorization header with an access token.
• Redacting/blocklists will need perpetual maintenance. Standards change, and there could be a new sensitive header that your code didn't expect.

Moving to a pure function that specifically pulls out the values you need in your logs is safer. Here is an example of what I've used:

const logger = require('pino-http')({
  serializers: {
    req: pino.stdSerializers.wrapRequestSerializer((req) => {
      return {
        id: req.raw.id,
        method: req.raw.method,
        path: req.raw.url.split('?')[0], // Remove query params which might be sensitive
        // Allowlist useful headers
        headers: {
          host: req.raw.headers.host,
          'user-agent': req.raw.headers['user-agent'],
          referer: req.raw.headers.referer,
        }
      };
    }),
    res: pino.stdSerializers.wrapResponseSerializer((res) => {
      return {
        statusCode: res.raw.statusCode,
        // Allowlist useful headers
        headers: {
          'content-type': res.raw.headers['content-type'],
          'content-length': res.raw.headers['content-length'],
        }
      };
    }),
  },
});

[kirillgroshkov]

What worked for me (I needed to only delete cookie from headers, not the whole headers):

export const httpLogger = pinoHttp({
  logger,
  serializers: {
    req: pino.stdSerializers.wrapRequestSerializer(r => {
      delete r.headers['cookie']
      return r
    }),
  },
})

[davidmarkclements]

So that can be done like so

var http = require('http')
var server = http.createServer(handle)
var logger = require('pino-http')({
  serializers: {
    req: (req) => ({
      id: req.id,
      method: req.method,
      url: req.url
    })
  }
})

function handle (req, res) {
  logger(req, res)
  res.end('hello world')
}

server.listen(3000)

That gets rid of header, and also remoteAddress and remotePort

[davidmarkclements]

serializers needs to be added to readme

[stephenmathieson]

perfect, thanks!