How to prevent ${aspnet-request-posted-body} to not log sensitive info

user_7155884 0
Viewed 457

I am using ${aspnet-request-post-body} to log the request body in log file. The problem I am facing: I want to prevent ${aspnet-request-post-body} to log some info i.e password and credit card details and I like to apply masking on them.

For example if request body is {username : ABC, password :554&3} this should be logged in this format {username: ABC, password : ****}

Please note I have already tried replace layout for this problem and don't want to use this. Is there any other way to do this task?

nlog logging c#
1 Answers

The ${aspnet-request-post-body} is only text for NLog.

So you have the following options:

  • replace all stuff (with a regex): example of config with replace all:

    <variable name="messageNoDigits" 
  value="${replace:inner=${message}:searchFor=(\\d{3\})+:replaceWith=:regex=true}" />

  • write your own custom layout renderer that parses the body as JSON and transforms it. Please note that reading the body in ASP.NET Core could be a bit tricky, see the current code in NLog for it. If you have the code for reading/transforming the body, it could be easily converted to a NLog layout renderer:

    using NLog.Web.LayoutRenderers; 

// register ${SanitizedBody}
AspNetLayoutRendererBase.Register("SanitizedBody", (logEventInfo, httpContext, loggingConfiguration) => MyMethod(httpContext));

    See https://github.com/NLog/NLog/wiki/How-to-write-a-custom-layout-renderer

user_2013030
Related