中文
devexamples

Pino Redaction of Sensitive Log Fields

Prevent secrets from leaking into logs by configuring Pino redaction paths, nested wildcard censoring, and strict serializer boundaries.

JavascriptResilience

Code

snippet
import { pino } from 'pino';

const logger = pino({
  redact: {
    paths: [
      'req.headers.authorization',
      'req.headers["x-api-key"]',
      'password',
      '*.token',
      'user.credentials.*',
    ],
    censor: (value) => (typeof value === 'string' ? '[redacted:' + value.length + ']' : '[redacted]'),
  },
});

const req = {
  id: 'req-91',
  headers: { authorization: 'Bearer eyJhbGciOi', 'x-api-key': 'sk-live-9f2' },
};

logger.info({ req, user: { token: 'abc123', name: 'ada' } }, 'authenticated request');
logger.info({ password: 'hunter2', nested: { token: 'zzz' } }, 'form submitted');

Related Examples