Production Quality & Security Structured Logging & Observability OWASP Secrets Sanitization Interactive Diagnostic Studio

Backend Logging

Understand application behavior, investigate production outages, and trace requests across asynchronous boundaries. Master Log Levels (DEBUG, INFO, WARN, ERROR), JSON structured formatting, correlation IDs, and OWASP data sanitization.

Core Logging Principle: Logging is for understanding and diagnosing discrete application behavior. Do not confuse logging with numeric metrics or distributed tracing. In production, logs must be structured JSON, contain a correlation ID, and NEVER expose sensitive secrets (passwords, tokens, or PII).

The Contextual Structured Logging Pipeline

EVENT 01

Request Received

Assign correlation reqId (HTTP 200/400)

EVENT 02

Domain Milestone

Order calculated, stock decremented

EVENT 03

Sanitization Filter

Redact passwords & auth tokens

EVENT 04

Aggregator Index

Elasticsearch / Datadog / Loki query

Structured Over Strings

Emitting JSON logs allows instant querying (`level:error AND orderId:101`) without brittle regex parsing.

OWASP Redaction Rules

Never log passwords, bearer tokens, or raw request body dumps. Treat log stores as high-value target assets.

Log Levels Matter

Restrict verbose DEBUG logging in production to protect CPU, event-loop throughput, and cloud ingestion costs.

SECTION 01

What Logging Is (and What It Isn't)

Understand the role of logs in the observability trifecta, and why random print statements fail in production.

What is a Log?

A log is an append-only, timestamped record of a discrete event that occurred inside an application. When an outage strikes at 3:00 AM, logs are the flight recorder that reconstructs reality:

Diagnosing Failures: Pinpointing the exact database query, parameter, or external API timeout that crashed a request.
Forensic Security Auditing: Investigating compromised accounts, brute-force attempts, or unauthorized access patterns.
Business Milestones: Confirming that an invoice was generated, an email was dispatched, or an inventory lock was acquired.

Logging vs. Metrics vs. Tracing

Engineers frequently blur these three pillars together. Here is how they cleanly differ:

Logs: Detailed event descriptions with text context ("User 42 failed payment because card expired").
Metrics: Numeric aggregations over time windows ("Payment failure rate is currently 4.2% across 1,000 requests").
Tracing: Visual spans tracking a single request flowing through Gateway → Service A → Service B → Database.

SECTION 02

Log Levels: DEBUG, INFO, WARN, ERROR

Choose appropriate severity levels to avoid flooding production systems while ensuring genuine errors trigger alerts.

Level	Intended Purpose	Production Status	Realistic Backend Example
DEBUG	Detailed developer tracing (SQL params, intermediate loop variables, raw payload shapes).	Disabled by default (Huge I/O & cost).	`DEBUG: Parsed 42 items from redis cache key 'user:101:cart'`
INFO	Coarse-grained operational milestones (server started, order created, worker processed batch).	Enabled (Baseline operational pulse).	`INFO: Order #9812 created for customer #44. Total: $150.00`
WARN	Unexpected conditions handled gracefully without failing the user (cache miss fallback, retry attempt).	Enabled (Monitored for degradation).	`WARN: Redis timeout. Falling back to primary Postgres query.`
ERROR	Actionable failures where an operation failed (unhandled exceptions, DB connection down, payment 500).	Enabled + Alerted (Triggers PagerDuty).	`ERROR: Stripe gateway timeout after 5000ms on order #9812`

SECTION 03

Structured Logging (JSON & Correlation IDs)

Stop outputting plain-text strings. Format logs as JSON so aggregators can index fields for instant search.

Unstructured Logging (Anti-Pattern)

// ❌ Unstructured plain text string console.log("Order 9912 failed for user 42 invalid payment");

Why it fails at scale:

Log aggregators must execute slow regex scans to extract the user ID or order ID.
Cannot filter by numeric values (e.g. latency > 500ms).
Interleaved concurrent logs are impossible to separate.

Structured JSON (Production Standard)

// ✅ Machine-readable structured JSON { "timestamp": "2026-09-11T16:45:00.120Z", "level": "error", "event": "order.payment_failed", "reqId": "req_88a91b", "orderId": "ord_9912", "userId": "user_42", "reason": "card_declined", "latencyMs": 340 }

Why it excels:

Directly queryable: event:order.payment_failed AND userId:user_42.
Correlation ID (reqId) groups all logs for that single HTTP request.

SECTION 04

Node.js & Express Practices (Pino / Winston)

Why console.log() is not enough for production, and how fast JSON loggers like Pino automate request tracing.

📁 Express with Pino & pino-http (Industry Standard)Fast JSON Logger

// server.js const express = require('express'); const pino = require('pino'); const pinoHttp = require('pino-http'); const app = express(); // 1. Configure Pino with OWASP credential redaction const logger = pino({ level: process.env.LOG_LEVEL || 'info', redact: ['req.headers.authorization', 'req.body.password'] }); // 2. Attach pino-http middleware: auto-assigns req.id & correlation ID app.use(pinoHttp({ logger, genReqId: (req) => req.headers['x-request-id'] || crypto.randomUUID() })); app.post('/api/orders', (req, res) => { // req.log automatically includes req.id in every JSON log! req.log.info({ orderId: 'ord_101', total: 50 }, 'Order placed successfully'); res.status(201).json({ status: 'ok' }); });

Why Pino Over console.log?

Zero Event-Loop Lag: console.log can be synchronous in Node.js when writing to terminals or file descriptors, causing thread blocking under load.
Built-in Redaction: Pino scrubs sensitive keys (password, authorization) automatically before writing to standard out.
Child Loggers: req.log inherits request correlation metadata without manually passing reqId into every function.

SECTION 05

Python & FastAPI Logging (exc_info)

Leverage Python's standard logging module with structured context and capture complete tracebacks safely.

📁 app/logger.py (Standard Library Logging)Python 3.10+

# app/logger.py import logging import sys # Configure root logger with custom format handler = logging.StreamHandler(sys.stdout) formatter = logging.Formatter( '{"time":"%(asctime)s", "level":"%(levelname)s", "message":"%(message)s"}' ) handler.setFormatter(formatter) logger = logging.getLogger("app") logger.setLevel(logging.INFO) logger.addHandler(handler)

📁 app/main.py (FastAPI with Exception Traceback)FastAPI Endpoint

# app/main.py from fastapi import FastAPI, HTTPException from app.logger import logger app = FastAPI() @app.post("/items") async def create_item(item_data: dict): try: # process item... logger.info(f"Item created: {item_data.get('id')}") return {"status": "ok"} except Exception as e: # exc_info=True attaches the entire traceback call stack! logger.error("Failed to create item", exc_info=True) raise HTTPException(status_code=500, detail="Internal server error")

SECTION 06

What NOT to Log (OWASP Security Rules)

Logs are persistent across backups, aggregators, and developer dashboards. Never log sensitive credentials or private user data.

Data Strictly Forbidden in Logs (OWASP)

Passwords: Plaintext, hashes, salts, or recovery codes.
Authentication Tokens: JWT Bearer tokens, OAuth refresh tokens, session cookies.
API Keys & Secrets: Stripe keys, AWS credentials, webhook secrets.
Financial Data: Full credit card numbers (PANs), CVVs, bank account numbers.
Unrestricted Dumps: Full req.body or raw query string dumps on checkout endpoints.

Safe Logging & Masking Techniques

Partial Masking: Displaying only the last 4 digits (e.g. cardEnding: "4242").
Redaction Placeholders: Replacing sensitive keys with [REDACTED].
Event Codes Over Text: Emitting discrete error codes (INVALID_CREDENTIALS) instead of echoing input.
Scoped Context: Log entity IDs (userId: "u_99") instead of full personal profiles.

SECTION 07

Interactive Logging & Debugging Studio

Hands-on exercise: An application has poor logging, a password leak, and an intermittent bug on large orders. Refactor the code to structured JSON logs, redact secrets, trigger requests, read the output, and fix the bug!

Interactive Studio: orderApp.js

// ❌ INSECURE & BUGGY: orderApp.js
// PROBLEMS:
// 1. Unstructured string logs (hard to search).
// 2. Critical OWASP violation: Logging client plaintext password!
// 3. Missing correlation ID (reqId).
// 4. Intermittent Bug: Orders over $500 fail because 'applyLuxuryTax' is broken!

const express = require('express');
const app = express();
app.use(express.json());

// In-Memory Database
const inventory = { 'prod_laptop': 10, 'prod_mouse': 50 };

app.post('/api/orders', (req, res) => {
  const { userId, password, productId, quantity, unitPrice } = req.body;

  // 💥 VULNERABILITY: Logging raw password in plain text!
  console.log("Processing order for user: " + userId + " with password: " + password);

  // Check inventory
  if (!inventory[productId] || inventory[productId] < quantity) {
    console.log("Stock check failed for " + productId);
    return res.status(409).json({ error: "INSUFFICIENT_STOCK" });
  }

  let subtotal = unitPrice * quantity;
  console.log("Subtotal calculated: " + subtotal);

  // 💥 HIDDEN BUG: Orders over $500 crash because applyLuxuryTax is not defined!
  let tax = 0;
  if (subtotal > 500) {
    try {
      // Buggy call:
      tax = applyLuxuryTax(subtotal); // ReferenceError: applyLuxuryTax is not defined!
    } catch (err) {
      // Poor context-free error logging!
      console.log("Something failed in tax!");
      return res.status(500).json({ error: "TAX_CALCULATION_ERROR" });
    }
  }

  inventory[productId] -= quantity;
  const total = subtotal + tax;

  console.log("Order success! Total: " + total);
  return res.status(201).json({
    success: true,
    order: { userId, productId, quantity, total }
  });
});

module.exports = app;

Live Application Log Console (stdout)STRUCTURED STREAM

No logs emitted yet. Click 'Send Small Order' or 'Send Large Order' above to trigger live requests.

SECTION 08

Production Debugging: 7 Logging Pitfalls

Analyze real-world architectural bugs where improper logging compromised security or made incident response impossible.

Scenario #1: Catastrophic Credential Leak: Logging Raw Request Bodies

Middleware logs the entire `req.body` for every incoming request, exposing plaintext user passwords.

Symptom: During a security audit, customer passwords and credit card details are discovered in plaintext inside Datadog/Elasticsearch logs.

Vulnerable Logging SnippetFLAW DETECTED

// ❌ BUGGY: middleware/requestLogger.js logs entire body without redaction app.use((req, res, next) => { // Catastrophic OWASP violation! console.log(`[${req.method}] ${req.url} - Body: ${JSON.stringify(req.body)}`); next(); });

How should this logging issue be resolved?

SECTION 09

Mini Challenge, 5 Golden Rules & Mastery Quiz

Test your incident investigation skills and solidify the 5 Golden Rules of production logging.

Incident Investigation Mini-Challenge

A customer reports that their order failed on POST /api/orders. You query your log aggregator and retrieve the following structured JSON record:

{ "timestamp": "2026-09-11T16:02:11.450Z", "level": "error", "event": "payment.gateway_timeout", "reqId": "req_882b", "orderId": "ord_9901", "userId": "user_771", "latencyMs": 5002, "message": "Payment provider failed to respond within deadline" }

Question 1: Given log line: `{"timestamp":"2026-09-11T16:02:11Z","level":"error","event":"payment.gateway_timeout","reqId":"req_882b","orderId":"ord_9901","latencyMs":5002}` — What caused the failure?

Question 2: In the above log, which field allows an engineer to find all preceding controller and service logs for that exact transaction?

5 Golden Rules of Production Logging

RULE 01

Emit Structured JSON

Always format logs as JSON objects with standardized keys (timestamp, level, event, reqId).

RULE 02

Never Log Secrets

OWASP rule: Scrub passwords, API keys, bearer tokens, and payment data. Redact request headers and query parameters.

RULE 03

Propagate Request IDs

Attach a correlation ID (reqId) at HTTP ingress and forward it into services, repositories, and queue payloads.

RULE 04

Right-Size Severity

Reserve ERROR for actionable system failures. User validation mistakes belong in WARN/INFO to avoid alert fatigue.

RULE 05

Avoid Loop Logging

Never log inside high-frequency loops in production. Emit aggregated summaries at INFO and restrict loop details to DEBUG.

QUESTION 1 OF 7Current Score: 0 / 7

What is the primary architectural purpose of logging in backend systems, and how does it differ from metrics and tracing?

Select your answer to unlock the next question

Backend Architecture Roadmap

Production Quality & Security Completed

Return to Backend Roadmap