[Logging] Masking authorization header

[amarlankri]

Add option to LoggingInterceptor to mask sensitive data of header request from the log.

Description

The solution implemented is described in #818.

Motivation and Context

Currently, all the headers of the request are logged:

nestjs-components/packages/logging-interceptor/src/logging.interceptor.ts

Lines 72 to 80 in c0b9a71

	this.logger.log(
	{
	message,
	method,
	body: maskedBody,
	headers,
	},
	ctx,
	);

However, those headers may contain sensitive data. Especially, the authorization header may contain a JWT which can encode sensitive data, readable by anyone once decoded. So, the logging interceptor should provide a way to mask request headers.

Fix #818

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)

[LeKer29]

LGTM, thank you @amarlankri ! :)

[LeKer29]

Suggested change

	... // Handle the header value to keep non sensitve data for instance
	... // Handle the header value to keep non sensitive data for instance

[qhdinh]

This is a user-defined function, so it's very error-prone. I think we should catch the exception during the function execution.

[qhdinh]

In case of exception, we could log the error message instead.

[amarlankri]

Not sure to understand your proposition. You mean passing the message of the exception as the value of the header?

[qhdinh]

This always logs the masked headers. I meant we should have an another flow to log the exception occured during the header masking.

[amarlankri]

I proposed an implementation in my last commit. Tell me if you thought about another solution.

[qhdinh]

I thought of logging the error and leaving the hearder value unmasked. But masking with default place holder is a better solution I think.