如何防止 ${aspnet-request-posted-body} 记录敏感信息

Question

我正在使用 ${aspnet-request-post-body} 记录请求体到日志文件中。我遇到的问题是：我想要防止 ${aspnet-request-post-body} 记录一些敏感信息，比如密码和信用卡详细信息，并且我希望对它们进行掩码处理。

例如，如果请求体是 {username: ABC, password:554&3}，那么应该以以下格式记录：{username: ABC, password: ****}

请注意，我已经尝试过使用替换布局来解决这个问题，并且不想使用它。有没有其他方法可以完成这个任务？

- user388231

---

也许可以创建一个高级的NLog LayoutRenderer，它可以解析文档（xml / json），并且可以指定属性值的转换。例如从 password: "xyz" 转换为 password: "***"。 - Rolf Kristensen

参见: https://github.com/NLog/NLog/issues/4145 - Rolf Kristensen

Answer 1

${aspnet-request-post-body} 是NLog中的纯文本。

因此，您有以下选项：

• replace all stuff (with a regex): example of config with replace all:

  <variable name="messageNoDigits" 
    value="${replace:inner=${message}:searchFor=(\\d{3\})+:replaceWith=:regex=true}" />
  

• write your own custom layout renderer that parses the body as JSON and transforms it. Please note that reading the body in ASP.NET Core could be a bit tricky, see the current code in NLog for it. If you have the code for reading/transforming the body, it could be easily converted to a NLog layout renderer:

  using NLog.Web.LayoutRenderers; 
  
  // register ${SanitizedBody}
  AspNetLayoutRendererBase.Register("SanitizedBody", (logEventInfo, httpContext, loggingConfiguration) => MyMethod(httpContext));
  

  See https://github.com/NLog/NLog/wiki/How-to-write-a-custom-layout-renderer

- Julian