Express Request Logger

A customizable Express request logger middleware that combines the power of Winston and Pino for comprehensive request logging.

Features

• Dual logging with both Winston and Pino
• Automatic request and response logging
• Sensitive data redaction (tokens, passwords, authorization headers)
• Customizable logging format (JSON or pretty-printed)
• Response time tracking
• Status code-based log levels
• TypeScript support

Installation

npm install @kephrenh/express-request-logger

Usage

import express from "express";
import { createRequestLogger } from "express-request-logger";
import winston from "winston";
import pino from "pino";

const app = express();

// Initialize your loggers
const winstonLogger = winston.createLogger({
  // Your Winston configuration
});

const pinoLogger = pino({
  // Your Pino configuration
});

// Create the request logger middleware
const requestLogger = createRequestLogger({
  tokens: ["accessToken", "refreshToken"], // Optional: tokens to redact
  pinoLogger,
  winstonLogger,
  pretty: true, // Optional: enable pretty printing
  json: false, // Optional: enable JSON format
});

// Use the middleware
app.use(requestLogger);

Configuration Options

| Option | Type | Default | Description | | ------------- | -------- | ------------------------------- | ------------------------------- | | tokens | string[] | ['accessToken', 'refreshToken'] | Array of cookie names to redact | | pinoLogger | Pino | Required | Pino logger instance | | winstonLogger | Winston | Required | Winston logger instance | | pretty | boolean | true | Enable pretty printing of logs | | json | boolean | false | Enable JSON format for logs |

Logged Information

The middleware logs the following information for each request:

• HTTP Method
• Request Path
• Timestamp
• IP Address
• Query Parameters
• Request Body (with sensitive data redaction)
• Cookies (with sensitive tokens redaction)
• Headers (with authorization header redaction)
• Response Status Code
• Response Time

Security

The middleware automatically redacts sensitive information:

• Passwords in login/register requests
• Authorization headers
• Specified tokens in cookies
• Custom tokens (configurable)

License

MIT

Author

Mohamed Amoussa