API with NestJS #130. Avoiding storing sensitive information in API logs

October 23, 2023

This entry is part 130 of 177 in the API with NestJS

In previous parts of this series, we’ve learned how to implement logging in our REST API. Logs play an important role in debugging and maintaining reliable services. However, they can pose security and privacy risks when misused. In this article, we will learn how to prevent sensitive information from being stored in our logs.

Logging with an interceptor

With interceptors, we can access and manipulate the data flowing between the client and the server. We can apply interceptors to controllers and routes in a similar way as middleware. Since interceptors can access the request and response, we can use an interceptor that logs incoming requests and our responses.

logger.interceptor.ts

import { Injectable, NestInterceptor } from '@nestjs/common';

@Injectable()

export class LoggerInterceptor implements NestInterceptor {

intercept() {

// ...

}

Our interceptors need to implement the NestInterceptor interface. This requires us to implement the intercept method that NestJS calls before invoking the controller method.

@Post('register')

@UseInterceptors(LoggerInterceptor)

async register(@Body() registrationData: RegisterDto) {

return this.authenticationService.register(registrationData);

}

This means that the intercept method is called before the register method.

logger.interceptor.ts

import {

Injectable,

NestInterceptor,

ExecutionContext,

CallHandler,

} from '@nestjs/common';

import { Request, Response } from 'express';

@Injectable()

export class LoggerInterceptor implements NestInterceptor {

intercept(context: ExecutionContext, next: CallHandler) {

const httpContext = context.switchToHttp();

const request = httpContext.getRequest<Request>();

const response = httpContext.getResponse<Response>();

// ...

return next.handle();

}

The intercept method has two arguments. The first is the context that provides the information about the incoming request. By using the context.switchToHttp() method, we can access the HTTP-specific context of a request. This allows us to use the getRequest and getResponse methods to access the Request and Response objects containing useful data related to the request and the response.

NestJS handles requests in a sequence called the request lifecycle that includes request processing, route handling, and generating the response. A request lifecycle consists of pieces such as guards, interceptors, pipes, and controller method handlers. The request lifecycle executes in a specific order. The second argument of the intercept method is the next object. Calling the next.handle() method tells NestJS to go to the next part of the request lifecycle. Forgetting about calling it would cause our API to hang.

NestJS uses interceptors before sending the response. Since we want to include the information about the response in our logs, we need to wait for NestJS to prepare the response. To do that, we can wait for the finish event to happen.

logger.interceptor.ts

import {

Injectable,

NestInterceptor,

ExecutionContext,

CallHandler,

Logger,

} from '@nestjs/common';

import { Request, Response } from 'express';

@Injectable()

export class LoggerInterceptor implements NestInterceptor {

private readonly logger = new Logger('HTTP');

intercept(context: ExecutionContext, next: CallHandler) {

const httpContext = context.switchToHttp();

const request = httpContext.getRequest<Request>();

const response = httpContext.getResponse<Response>();

response.on('finish', () => {

const { method, originalUrl } = request;

const { statusCode, statusMessage } = response;

const message = `${method} ${originalUrl} ${statusCode} ${statusMessage}`;

if (statusCode >= 500) {

return this.logger.error(message);

}

if (statusCode >= 400) {

return this.logger.warn(message);

}

return this.logger.log(message);

});

return next.handle();

}

Above, we log a message that contains the HTTP method, the URL of the request, and the status. We can use the useGlobalInterceptors to attach our interceptor to all routes.

main.ts

import { NestFactory } from '@nestjs/core';

import { AppModule } from './app.module';

import { LogLevel } from '@nestjs/common';

import { LoggerInterceptor } from './utils/logger.interceptor';

async function bootstrap() {

const isProduction = process.env.NODE_ENV === 'production';

const logLevels: LogLevel[] = isProduction

? ['error', 'warn', 'log']

: ['error', 'warn', 'log', 'verbose', 'debug'];

const app = await NestFactory.create(AppModule, {

logger: logLevels,

});

app.useGlobalInterceptors(new LoggerInterceptor());

// ...

await app.listen(3000);

}

bootstrap();

If you want to know more about logging with NestJS, check out API with NestJS #113. Logging with Prisma

Handling the sensitive information

The above log might not be enough to debug our application and determine what’s wrong. To do that, we might want to store the request body.

const { method, originalUrl, body } = request;

const { statusCode, statusMessage } = response;

const message = `${method} ${originalUrl} ${statusCode} ${statusMessage} Request body: ${JSON.stringify(

body,

)}`;

The problem with the above approach is that we log sensitive information, such as plain text passwords. Let’s use the class-transformer library to create a Data Transfer Object class that hides the password.

registrationRequestLogging.dto.ts

import { Transform } from 'class-transformer';

class RegistrationRequestLoggingDto {

email: string;

name: string;

@Transform(({ obj }) => {

return `[${typeof obj.password}]`;

})

password: string;

}

export default RegistrationRequestLoggingDto;

Above, we are using the Transform decorator to store the type of the value instead of the value itself.

Attaching the DTO to the route

We now need a way to attach our new DTO class to a specific route. To do that, we can create a decorator that uses SetMetadata.

parseRequestBodyWhenLogging.ts

import { SetMetadata } from '@nestjs/common';

import { Class } from 'type-fest';

export const PARSE_REQUEST_BODY_WHEN_LOGGING_KEY = 'request_body_logging';

export const ParseRequestBodyWhenLogging = (dtoClass: Class<unknown>) => {

return SetMetadata(PARSE_REQUEST_BODY_WHEN_LOGGING_KEY, dtoClass);

};

We are using the Class type from the type-fest library to represent any class.

With SetMetadata, we can assign metadata to a particular method.

authentication.controller.ts

import {

Body,

Controller,

Post,

UseInterceptors,

ClassSerializerInterceptor,

} from '@nestjs/common';

import { AuthenticationService } from './authentication.service';

import RegisterDto from './dto/register.dto';

import { ParseRequestBodyWhenLogging } from '../utils/parseRequestBodyWhenLogging';

import RegistrationRequestLoggingDto from './dto/registrationRequestLogging.dto';

@Controller('authentication')

@UseInterceptors(ClassSerializerInterceptor)

export class AuthenticationController {

constructor(private readonly authenticationService: AuthenticationService) {}

@Post('register')

@ParseRequestBodyWhenLogging(RegistrationRequestLoggingDto)

async register(@Body() registrationData: RegisterDto) {

return this.authenticationService.register(registrationData);

}

// ...

}

Thanks to our @ParseRequestBodyWhenLogging() decorator, we’ve assigned the RegistrationRequestLoggingDto class to the register method. Let’s now modify our logging interceptor to take it into account. First, we need to give it access to the reflector that allows us to retrieve the metadata we assigned to the register method.

main.ts

import { NestFactory, Reflector } from '@nestjs/core';

import { AppModule } from './app.module';

import { LogLevel } from '@nestjs/common';

import { LoggerInterceptor } from './utils/logger.interceptor';

async function bootstrap() {

const isProduction = process.env.NODE_ENV === 'production';

const logLevels: LogLevel[] = isProduction

? ['error', 'warn', 'log']

: ['error', 'warn', 'log', 'verbose', 'debug'];

const app = await NestFactory.create(AppModule, {

logger: logLevels,

});

app.useGlobalInterceptors(new LoggerInterceptor(app.get(Reflector)));

// ...

await app.listen(3000);

}

bootstrap();

We can now create the parseRequestBody method that uses the reflector to get the DTO class and create its instance.

logger.interceptor.ts

import {

Injectable,

NestInterceptor,

ExecutionContext,

CallHandler,

Logger,

} from '@nestjs/common';

import { Request, Response } from 'express';

import { Reflector } from '@nestjs/core';

import { PARSE_REQUEST_BODY_WHEN_LOGGING_KEY } from './parseRequestBodyWhenLogging';

import { plainToInstance } from 'class-transformer';

import { Constructor } from 'type-fest';

@Injectable()

export class LoggerInterceptor implements NestInterceptor {

constructor(private readonly reflector: Reflector) {}

private readonly logger = new Logger('HTTP');

private parseRequestBody(context: ExecutionContext) {

const httpContext = context.switchToHttp();

const request = httpContext.getRequest<Request>();

const body: unknown = request.body;

if (!body) {

return;

if (body === null || typeof body !== 'object') {

return body;

}

const requestBodyDto = this.reflector.getAllAndOverride<

Constructor<unknown>

>(PARSE_REQUEST_BODY_WHEN_LOGGING_KEY, [

context.getHandler(),

context.getClass(),

]);

if (!requestBodyDto) {

return JSON.stringify(body);

}

const instance = plainToInstance(requestBodyDto, body);

return JSON.stringify(instance);

}

intercept(context: ExecutionContext, next: CallHandler) {

const httpContext = context.switchToHttp();

const request = httpContext.getRequest<Request>();

const response = httpContext.getResponse<Response>();

response.on('finish', () => {

const { method, originalUrl } = request;

const { statusCode, statusMessage } = response;

const message = `${method} ${originalUrl} ${statusCode} ${statusMessage} Request body: ${this.parseRequestBody(

context,

)}`;

if (statusCode >= 500) {

return this.logger.error(message);

}

if (statusCode >= 400) {

return this.logger.warn(message);

}

return this.logger.log(message);

});

return next.handle();

}

If a particular route does not have the @ParseRequestBodyWhenLogging() decorator, our interceptor does not parse the body. If it does, we use the plainToInstance function to create an instance of our DTO class. Thanks to that, we can hide the actual value of the password field.

In the above log, we can see that the endpoint responded with 400 Bad Request. The request body shows that the user provided a number as a password instead of a string. Therefore, our API is expected to respond with the error.

Summary

In this article, we’ve explained how to implement logging using interceptors. We’ve also created a custom decorator that allows us to avoid storing sensitive data in our logs. Feel free to use this solution in more routes, such as the one used for logging in. We can also use a similar approach to parsing the response body by creating a similar decorator. All of the above gives us much more control over what we store in our logs.

Series Navigation<< API with NestJS #129. Implementing soft deletes with SQL and KyselyAPI with NestJS #131. Unit tests with PostgreSQL and Kysely >>