Add module with example of masking sensitive information in logs

andrei-punko · andrei-punko · commit 6ad0ac817c1e · 2026-04-27T18:00:10.000+03:00
diff --git a/README.md b/README.md
@@ -67,6 +67,10 @@ Example of OpenApi generation:
 
 [Example](messaging-stomp-websocket) of STOMP messaging over WebSockets for building interactive web application
 
+### mask-logs-spring-boot-sample
+
+[Example](mask-logs-spring-boot-sample/README.md) of masking secure information in logs in Spring Boot using custom Logback converter/appender
+
 ### sound-recorder-n-spectrum-analyzer
 
 - [Application](sound-recorder-n-spectrum-analyzer/src/main/java/by/andd3dfx/capturesound/AudioCaptureApp.java) to
diff --git a/mask-logs-spring-boot-sample/README.md b/mask-logs-spring-boot-sample/README.md
@@ -0,0 +1,42 @@
+# Mask logs Spring Boot sample
+
+Example of masking sensitive values in Spring Boot logs using custom Logback extensions:
+
+- converter: `MaskingMessageConverter`
+- appender: `MaskingConsoleAppender`
+
+Masking is implemented in `LogMaskingSupport` (`password`, `token`, `authorization`, `Bearer ...`, long digit sequences).
+
+## Run
+
+```bash
+../mvnw spring-boot:run -pl mask-logs-spring-boot-sample
+```
+
+## Try
+
+```bash
+curl -X POST http://localhost:8080/api/auth/login \
+  -H "Content-Type: application/json" \
+  -d "{\"username\":\"john\",\"password\":\"secret123\",\"cardNumber\":\"4111111111111111\"}"
+```
+
+Expected log fragments:
+
+```text
+password=***
+token=***
+Authorization=***
+cardNumber=************
+```
+
+## Switch converter/appender
+
+`src/main/resources/logback-spring.xml` uses `MASKED_CONVERTER` by default.
+To use appender-based masking, switch root appender reference to `MASKED_APPENDER`.
+
+## Tests
+
+```bash
+../mvnw -pl mask-logs-spring-boot-sample test
+```
diff --git a/mask-logs-spring-boot-sample/pom.xml b/mask-logs-spring-boot-sample/pom.xml
@@ -0,0 +1,56 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+    <parent>
+        <artifactId>java-sandbox</artifactId>
+        <groupId>by.andd3dfx</groupId>
+        <version>1.0-SNAPSHOT</version>
+    </parent>
+    <modelVersion>4.0.0</modelVersion>
+
+    <artifactId>mask-logs-spring-boot-sample</artifactId>
+
+    <properties>
+        <maven.compiler.source>${java.version}</maven.compiler.source>
+        <maven.compiler.target>${java.version}</maven.compiler.target>
+    </properties>
+
+    <dependencies>
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-web</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-test</artifactId>
+            <scope>test</scope>
+            <exclusions>
+                <exclusion>
+                    <groupId>org.junit.vintage</groupId>
+                    <artifactId>junit-vintage-engine</artifactId>
+                </exclusion>
+            </exclusions>
+        </dependency>
+    </dependencies>
+
+    <dependencyManagement>
+        <dependencies>
+            <dependency>
+                <groupId>org.junit</groupId>
+                <artifactId>junit-bom</artifactId>
+                <version>5.9.2</version>
+                <scope>import</scope>
+                <type>pom</type>
+            </dependency>
+            <dependency>
+                <groupId>org.springframework.boot</groupId>
+                <artifactId>spring-boot-dependencies</artifactId>
+                <version>${spring-boot.version}</version>
+                <type>pom</type>
+                <scope>import</scope>
+            </dependency>
+        </dependencies>
+    </dependencyManagement>
+
+</project>
diff --git a/mask-logs-spring-boot-sample/src/main/java/by/andd3dfx/masklogs/MaskLogsSpringBootSampleApplication.java b/mask-logs-spring-boot-sample/src/main/java/by/andd3dfx/masklogs/MaskLogsSpringBootSampleApplication.java
@@ -0,0 +1,12 @@
+package by.andd3dfx.masklogs;
+
+import org.springframework.boot.SpringApplication;
+import org.springframework.boot.autoconfigure.SpringBootApplication;
+
+@SpringBootApplication
+public class MaskLogsSpringBootSampleApplication {
+
+    public static void main(String[] args) {
+        SpringApplication.run(MaskLogsSpringBootSampleApplication.class, args);
+    }
+}
diff --git a/mask-logs-spring-boot-sample/src/main/java/by/andd3dfx/masklogs/api/AuthController.java b/mask-logs-spring-boot-sample/src/main/java/by/andd3dfx/masklogs/api/AuthController.java
@@ -0,0 +1,33 @@
+package by.andd3dfx.masklogs.api;
+
+import java.util.Map;
+import java.util.UUID;
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.http.MediaType;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RequestBody;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+@RestController
+@RequestMapping(path = "/api/auth", produces = MediaType.APPLICATION_JSON_VALUE)
+public class AuthController {
+
+    private static final Logger LOG = LoggerFactory.getLogger(AuthController.class);
+
+    @PostMapping(path = "/login", consumes = MediaType.APPLICATION_JSON_VALUE)
+    public Map<String, String> login(@RequestBody AuthRequest request) {
+        LOG.info("Received login request: {}", request);
+
+        String token = UUID.randomUUID().toString().replace("-", "");
+        LOG.info("Generated token={} for user={}", token, request.username());
+        LOG.info("Authorization=Bearer {}", token);
+
+        return Map.of(
+                "status", "OK",
+                "token", token
+        );
+    }
+}
diff --git a/mask-logs-spring-boot-sample/src/main/java/by/andd3dfx/masklogs/api/AuthRequest.java b/mask-logs-spring-boot-sample/src/main/java/by/andd3dfx/masklogs/api/AuthRequest.java
@@ -0,0 +1,8 @@
+package by.andd3dfx.masklogs.api;
+
+public record AuthRequest(
+        String username,
+        String password,
+        String cardNumber
+) {
+}
diff --git a/mask-logs-spring-boot-sample/src/main/java/by/andd3dfx/masklogs/logging/LogMaskingSupport.java b/mask-logs-spring-boot-sample/src/main/java/by/andd3dfx/masklogs/logging/LogMaskingSupport.java
@@ -0,0 +1,46 @@
+package by.andd3dfx.masklogs.logging;
+
+import java.util.List;
+import java.util.regex.Pattern;
+
+public final class LogMaskingSupport {
+
+    private static final String MASK = "***";
+
+    private static final List<MaskRule> RULES = List.of(
+            new MaskRule(
+                    Pattern.compile("(?i)(\"?(?:password|pass|pwd|secret|token|accessToken|refreshToken|authorization)\"?\\s*[:=]\\s*\")([^\"]+)(\")"),
+                    "$1" + MASK + "$3"
+            ),
+            new MaskRule(
+                    Pattern.compile("(?i)(\\b(?:password|pass|pwd|secret|token|accessToken|refreshToken|authorization)\\b\\s*[:=]\\s*)([^,}\\]]+)"),
+                    "$1" + MASK
+            ),
+            new MaskRule(
+                    Pattern.compile("(?i)(\\bBearer\\s+)([A-Za-z0-9._\\-]+)"),
+                    "$1" + MASK
+            ),
+            new MaskRule(
+                    Pattern.compile("\\b\\d{12,19}\\b"),
+                    "************"
+            )
+    );
+
+    private LogMaskingSupport() {
+    }
+
+    public static String mask(String source) {
+        if (source == null || source.isEmpty()) {
+            return source;
+        }
+
+        String masked = source;
+        for (MaskRule rule : RULES) {
+            masked = rule.pattern().matcher(masked).replaceAll(rule.replacement());
+        }
+        return masked;
+    }
+
+    private record MaskRule(Pattern pattern, String replacement) {
+    }
+}
diff --git a/mask-logs-spring-boot-sample/src/main/java/by/andd3dfx/masklogs/logging/MaskingConsoleAppender.java b/mask-logs-spring-boot-sample/src/main/java/by/andd3dfx/masklogs/logging/MaskingConsoleAppender.java
@@ -0,0 +1,28 @@
+package by.andd3dfx.masklogs.logging;
+
+import java.time.Instant;
+import java.time.ZoneId;
+import java.time.format.DateTimeFormatter;
+
+import ch.qos.logback.classic.spi.ILoggingEvent;
+import ch.qos.logback.core.AppenderBase;
+
+public class MaskingConsoleAppender extends AppenderBase<ILoggingEvent> {
+
+    private static final DateTimeFormatter TS_FORMATTER = DateTimeFormatter.ofPattern("yyyy-MM-dd HH:mm:ss.SSS")
+            .withZone(ZoneId.systemDefault());
+
+    @Override
+    protected void append(ILoggingEvent eventObject) {
+        String timestamp = TS_FORMATTER.format(Instant.ofEpochMilli(eventObject.getTimeStamp()));
+        String message = LogMaskingSupport.mask(eventObject.getFormattedMessage());
+        String line = "%s %-5s [%s] %s - %s%n".formatted(
+                timestamp,
+                eventObject.getLevel(),
+                eventObject.getThreadName(),
+                eventObject.getLoggerName(),
+                message
+        );
+        System.out.print(line);
+    }
+}
diff --git a/mask-logs-spring-boot-sample/src/main/java/by/andd3dfx/masklogs/logging/MaskingMessageConverter.java b/mask-logs-spring-boot-sample/src/main/java/by/andd3dfx/masklogs/logging/MaskingMessageConverter.java
@@ -0,0 +1,12 @@
+package by.andd3dfx.masklogs.logging;
+
+import ch.qos.logback.classic.pattern.ClassicConverter;
+import ch.qos.logback.classic.spi.ILoggingEvent;
+
+public class MaskingMessageConverter extends ClassicConverter {
+
+    @Override
+    public String convert(ILoggingEvent event) {
+        return LogMaskingSupport.mask(event.getFormattedMessage());
+    }
+}
diff --git a/mask-logs-spring-boot-sample/src/main/resources/application.yml b/mask-logs-spring-boot-sample/src/main/resources/application.yml
@@ -0,0 +1,3 @@
+spring:
+  application:
+    name: mask-logs-spring-boot-sample
diff --git a/mask-logs-spring-boot-sample/src/main/resources/logback-spring.xml b/mask-logs-spring-boot-sample/src/main/resources/logback-spring.xml
@@ -0,0 +1,27 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<configuration>
+
+    <conversionRule conversionWord="maskedMsg"
+                    converterClass="by.andd3dfx.masklogs.logging.MaskingMessageConverter"/>
+
+    <appender name="MASKED_CONVERTER" class="ch.qos.logback.core.ConsoleAppender">
+        <encoder>
+            <pattern>%d{yyyy-MM-dd HH:mm:ss.SSS} %-5level [%thread] %logger - %maskedMsg%n</pattern>
+        </encoder>
+    </appender>
+
+    <appender name="MASKED_APPENDER" class="by.andd3dfx.masklogs.logging.MaskingConsoleAppender"/>
+
+    <!-- Default option: masking in custom converter -->
+    <root level="INFO">
+        <appender-ref ref="MASKED_CONVERTER"/>
+    </root>
+
+    <!-- Alternative option: masking in custom appender -->
+    <!--
+    <root level="INFO">
+        <appender-ref ref="MASKED_APPENDER"/>
+    </root>
+    -->
+
+</configuration>
diff --git a/mask-logs-spring-boot-sample/src/test/java/by/andd3dfx/masklogs/api/AuthControllerLogMaskingIntegrationTest.java b/mask-logs-spring-boot-sample/src/test/java/by/andd3dfx/masklogs/api/AuthControllerLogMaskingIntegrationTest.java
@@ -0,0 +1,49 @@
+package by.andd3dfx.masklogs.api;
+
+import java.util.Map;
+
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.Test;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.boot.test.context.SpringBootTest;
+import org.springframework.boot.test.system.CapturedOutput;
+import org.springframework.boot.test.system.OutputCaptureExtension;
+import org.springframework.boot.test.web.client.TestRestTemplate;
+import org.springframework.http.HttpEntity;
+import org.springframework.http.HttpHeaders;
+import org.springframework.http.HttpStatus;
+import org.springframework.http.MediaType;
+import org.springframework.http.ResponseEntity;
+import org.springframework.test.context.junit.jupiter.SpringExtension;
+import org.junit.jupiter.api.extension.ExtendWith;
+
+@ExtendWith({SpringExtension.class, OutputCaptureExtension.class})
+@SpringBootTest(webEnvironment = SpringBootTest.WebEnvironment.RANDOM_PORT)
+class AuthControllerLogMaskingIntegrationTest {
+
+    @Autowired
+    private TestRestTemplate restTemplate;
+
+    @Test
+    void shouldMaskSensitiveValuesInLogs(CapturedOutput output) {
+        Map<String, String> body = Map.of(
+                "username", "john",
+                "password", "secret123",
+                "cardNumber", "4111111111111111"
+        );
+
+        HttpHeaders headers = new HttpHeaders();
+        headers.setContentType(MediaType.APPLICATION_JSON);
+        HttpEntity<Map<String, String>> request = new HttpEntity<>(body, headers);
+
+        ResponseEntity<Map> response = restTemplate.postForEntity("/api/auth/login", request, Map.class);
+
+        Assertions.assertEquals(HttpStatus.OK, response.getStatusCode());
+        String logs = output.getOut();
+        Assertions.assertFalse(logs.contains("secret123"));
+        Assertions.assertFalse(logs.contains("4111111111111111"));
+        Assertions.assertFalse(logs.contains("Bearer "));
+        Assertions.assertTrue(logs.contains("password=***") || logs.contains("password\":\"***\""));
+        Assertions.assertTrue(logs.contains("************"));
+    }
+}
diff --git a/mask-logs-spring-boot-sample/src/test/java/by/andd3dfx/masklogs/logging/LogMaskingSupportTest.java b/mask-logs-spring-boot-sample/src/test/java/by/andd3dfx/masklogs/logging/LogMaskingSupportTest.java
@@ -0,0 +1,26 @@
+package by.andd3dfx.masklogs.logging;
+
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.Test;
+
+class LogMaskingSupportTest {
+
+    @Test
+    void shouldMaskKnownSensitivePatterns() {
+        String input = """
+                payload={"username":"john","password":"secret123"}
+                token=abc12345
+                Authorization=Bearer qwerty0987
+                cardNumber=4111111111111111
+                """;
+
+        String masked = LogMaskingSupport.mask(input);
+
+        Assertions.assertFalse(masked.contains("secret123"));
+        Assertions.assertFalse(masked.contains("abc12345"));
+        Assertions.assertFalse(masked.contains("qwerty0987"));
+        Assertions.assertFalse(masked.contains("4111111111111111"));
+        Assertions.assertTrue(masked.contains("password\":\"***\""));
+        Assertions.assertTrue(masked.contains("token=***"));
+    }
+}
diff --git a/pom.xml b/pom.xml
@@ -22,6 +22,7 @@
     <module>grpc-sample</module>
     <module>hibernate-mappings</module>
     <module>messaging-stomp-websocket</module>
+    <module>mask-logs-spring-boot-sample</module>
     <module>sound-recorder-n-spectrum-analyzer</module>
     <module>test-containers</module>
     <module>two-factor-authentication</module>

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,3 @@`
	`1`	`+spring:`
	`2`	`+ application:`
	`3`	`+ name: mask-logs-spring-boot-sample`