Pino: Object passed during logger instantiation not redacted

Created on 26 May 2020 · 4Comments · Source: pinojs/pino

Custom object properties are not redacted. This is especially critical for the pino-http package. There the req object can't be redacted, so things like req.headers.authorization are always exposed to logs.

Example code:

const pino = require('pino')
const express = require('express')
const expressPino = require('express-pino-logger')

const logger = pino({
    redact: {
      paths: ['*.headers.authorization'],
    },
  })

const app = express()

app.use(
  expressPino({
    logger,
  })  
)

app.listen(8000)

Start the app and do a http request:
curl -H "authorization: Bearer test" http://localhost:8000.
You will see that req.headers.authorization is not redacted.

What happens is that the req object is never passed to log redaction, because it is not passed to the logger functions, but during child logger instantiation:
https://github.com/pinojs/pino-http/blob/d593aa6084f1fe70a506ad8f202fc7f339b87fb5/logger.js#L94

Would be great if pino would redact custom log properties.

bug

Source