Insufficient Logging in Express (Javascript)

Insufficient logging in an Express application written in JavaScript means important events, errors, and security-relevant activities are not recorded, or are recorded without sufficient detail to support investigation. This lack of visibility weakens detection, response, and forensic analysis across multiple security domains, including authentication, authorization, input validation, and data exposure.

When security controls are limited to runtime detection only, findings such as unauthorized access or malformed requests may go unrecorded. For example, an attacker probing for IDOR endpoints or testing authentication bypass techniques can leave few traces if HTTP status codes, request paths, user identifiers, and outcome details are not consistently logged. Logging that captures only high-level errors without context (e.g., missing request IDs, sanitized paths, or missing timestamps) reduces the usefulness of logs during incident triage.

JavaScript-specific patterns can exacerbate these gaps. Dynamic route parameters, loosely typed data, and middleware chains may omit logging when errors are caught generically. If middleware does not explicitly log critical stages—such as authentication verification, authorization decisions, or input validation failures—security-relevant context is lost. Additionally, asynchronous flows in JavaScript can interleave operations, and without structured, correlated logging, it becomes difficult to reconstruct the timeline of a suspicious activity.

Real-world attack patterns highlight the impact. For instance, without sufficient logging, an attacker conducting authentication abuse or exploiting BOLA (Broken Level of Authorization) may not trigger alerts, because failed authentication or unexpected ID transitions are not recorded with sufficient granularity. Similarly, input validation issues that lead to data exposure or SSRF may remain invisible if responses, status codes, and payloads are not logged in a structured way. Even when logs exist, they may not align with compliance frameworks such as OWASP API Top 10 or SOC2, which emphasize auditability and traceability for security-relevant events.

middleBrick scans identify insufficient logging by correlating runtime behavior with expected security controls across checks such as Authentication, Authorization, Input Validation, and Data Exposure. The scanner does not fix logging implementation, but its findings highlight where telemetry is missing or incomplete, enabling teams to strengthen observability and align with best practices. Teams can then use the findings to improve logging strategies, ensuring that security events are recorded with sufficient detail for detection, response, and audit purposes.

To address insufficient logging in Express with JavaScript, implement structured, consistent, and security-aware logging across middleware, routes, and error handlers. Use a dedicated logging library, enrich logs with contextual identifiers, and ensure sensitive data is not exposed. Below are concrete, realistic code examples you can apply in your Express application.

1. Use a structured logger and include request-scoped context. For example, use pino or winston to emit JSON-formatted logs that include timestamps, request IDs, HTTP method, path, status, and user context when available.

const pino = require('pino');
const logger = pino({
  level: 'info',
  base: null,
  timestamp: pino.stdTimeFunctions.isoTime
});

function requestLogger(req, res, next) {
  const start = Date.now();
  const requestId = req.id || require('crypto').randomUUID();
  req.id = requestId;
  res.on('finish', () => {
    const elapsed = Date.now() - start;
    logger.info({
      reqId: requestId,
      method: req.method,
      url: req.originalUrl,
      statusCode: res.statusCode,
      elapsedMs: elapsed,
      userId: req.user ? req.user.id : null,
      ip: req.ip
    });
  });
  next();
}

module.exports = { requestLogger, logger };

2. Log authentication and authorization outcomes explicitly in your middleware. Record both successes and failures, including the principal identifier when available, and avoid logging sensitive credentials.

const { logger } = require('./logger');

function authMiddleware(req, res, next) {
  const token = req.headers.authorization?.split(' ')[1];
  if (!token) {
    logger.warn({ event: 'auth_failure', reason: 'missing_token', reqId: req.id });
    return res.status(401).json({ error: 'unauthorized' });
  }
  try {
    const payload = verifyToken(token); // your verification logic
    req.user = payload;
    logger.info({ event: 'auth_success', userId: payload.sub, reqId: req.id });
    return next();
  } catch (err) {
    logger.warn({ event: 'auth_failure', reason: 'invalid_token', reqId: req.id, error: err.message });
    return res.status(401).json({ error: 'invalid_token' });
  }
}

function ensureScope(requiredScope) {
  return (req, res, next) => {
    const userScopes = req.user?.scopes || [];
    if (!userScopes.includes(requiredScope)) {
      logger.warn({ event: 'authz_denied', userId: req.user?.id, requiredScope, reqId: req.id });
      return res.status(403).json({ error: 'forbidden' });
    }
    logger.info({ event: 'authz_granted', userId: req.user?.id, requiredScope, reqId: req.id });
    return next();
  };
}

module.exports = { authMiddleware, ensureScope };

3. Log input validation and business-layer errors with sufficient detail for debugging, but avoid exposing sensitive data. Include the field name, received value summary, and a stable error code.

const { logger } = require('./logger');

function validateCreateUser(req, res, next) {
  const errors = [];
  if (!req.body.email || !req.body.email.includes('@')) {
    errors.push({ field: 'email', received: typeof req.body.email === 'string' ? req.body.email.substring(0, 20) : req.body.email });
  }
  if (!req.body.username || req.body.username.length < 3) {
    errors.push({ field: 'username', received: typeof req.body.username === 'string' ? req.body.username.substring(0, 20) : req.body.username });
  }
  if (errors.length > 0) {
    logger.warn({ event: 'validation_failed', errors, reqId: req.id });
    return res.status(400).json({ error: 'validation_failed', details: errors });
  }
  return next();
}

// Example usage in a route
app.post('/users', requestLogger, validateCreateUser, (req, res) => {
  // business logic
  res.status(201).json({ id: 123, email: req.body.email });
});

4. Ensure uncaught exceptions and promise rejections are logged with stack traces and request context, so that unexpected behavior is observable. Combine this with a centralized log management workflow for ongoing analysis.

const { logger } = require('./logger');

process.on('unhandledRejection', (reason, promise) => {
  logger.error({ event: 'unhandled_rejection', reason: reason && reason.message ? reason.message : String(reason), promiseStack: promise && promise.stack ? promise.stack.substring(0, 200) : null });
});

process.on('uncaughtException', (err) => {
  logger.error({ event: 'uncaught_exception', error: err && err.message ? err.message : String(err), stack: err && err.stack ? err.stack.substring(0, 500) : null });
  // Graceful shutdown may be appropriate in your environment
});

// Express error handler should be the last middleware
app.use((err, req, res, next) => {
  logger.error({ event: 'express_error', error: err && err.message ? err.message : String(err), stack: err && err.stack ? err.stack.substring(0, 500) : null, reqId: req.id });
  res.status(500).json({ error: 'internal_server_error' });
});

5. Correlate logs across asynchronous operations by propagating request IDs and including them in all log lines. This practice is especially important in JavaScript due to its non-blocking I/O and event loop behavior.

These JavaScript-specific fixes help ensure that security events such as authentication bypass attempts, IDOR probes, input validation failures, and data exposure are recorded with sufficient detail. By combining structured logging, contextual fields, and robust error capture, you improve auditability and support faster incident investigation.