Logging a whole request body, or the headers, on a route that handles authentication copies passwords, tokens, and API keys straight into your logs in plain text. Those logs flow into aggregators, error trackers, and backups where they persist far longer than intended and are readable by anyone with log access. Log only the non-sensitive fields you actually need.
Why it's a problem
Secrets in logs are secrets in a second, less-guarded place. Log platforms are widely accessible within a team, retained for a long time, and often shipped to third-party services, so a password captured in a log is exposed to everyone and everything that can read those logs. It also turns a minor log leak into a credential breach.
The pattern
app.post("/login", (req, res) => {
console.log("login attempt", req.body); // logs the password
// ...
});The fix
app.post("/login", (req, res) => {
console.log("login attempt", { email: req.body.email });
// never log passwords, tokens, or full request bodies
});Why AI tools write this
Logging the request for debugging is a natural, helpful-looking addition, and dumping req.body is the quickest way to see everything. The assistant is not tracking which fields are secret, so it logs the whole object, password included.
The quick fix
- Log only the specific non-sensitive fields you need, never the full request body.
- Redact passwords, tokens, API keys, and authorization headers before logging.
- Scrub existing logs if secrets were already written to them.