Untitled Lesson
Skill Matrix
UNLOCK NODES BY LEARNING NEW TAGS.
Why is a structured JSON logger generally preferred over plain console.log statements in a production Node.js service?
💻 Code Challenge | +75 XP
Set up a pino logger with a redact config for password and authorization header fields, and create a child logger middleware that binds a per-request requestId to every log call within that request.
A security review found that a plaintext password was visible in production logs after a failed login attempt. Reorder the steps to fix the root cause.
Task: Reorder the blocks in logical sequence to solve the problem.
A.D.A. Interface
Adaptive Didactic Assistant
Pascual Vila
Frontend Instructor // Code Syllabus
The Error //
Logging an entire request body or object without redacting sensitive fields
// Wrong: logs whatever the body happens to contain
logger.info(req.body);
// Correct: automatic redaction configured once
const logger = pino({ redact: ["req.body.password", "req.body.token"] });The Solution //
A convenient app.use((req) => logger.info(req.body)) habit will eventually log a plaintext password, API key, or credit card number the moment a request happens to contain one — logs are frequently shipped to less-secured aggregation systems than the application itself. Configure automatic redaction for known-sensitive field names.
The Error //
Using string concatenation or template literals to build a "structured-looking" log message
// Wrong: fragile, manually-built pseudo-JSON string
console.log('{"user":"' + username + '"}');
// Correct: real structured logging
logger.info({ user: username }, "User action");The Solution //
Manually building a string that looks like JSON (`'{"user":"' + username + '"}'`) is fragile and breaks the moment a value contains a quote or special character, and it gains none of the actual benefits of a structured logger's optimized serialization or level filtering. Pass an object as the first argument to the logger instead.