The Ultimate Guide to HTTP Logging in ASP.NET Core: From Basic Configuration to Sensitive Data Redaction Practices

Logging HTTP requests and responses can help developers quickly troubleshoot issues, monitor performance, and audit user behavior. ASP.NET Core provides out-of-the-box support through the built-in <span>HttpLogging</span> middleware, which you can flexibly configure and extend according to your needs.

This article covers in-depth: 🔹 Enabling and configuring HTTP logging in ASP.NET Core projects 🔹 Detailed explanation of logging options and settings 🔹 Custom logging and endpoint-level configuration 🔹 Sensitive data redaction techniques 🔹 Logging requests and responses made by <span>HttpClient</span>.

Visit my website for best practices in .NET and architecture Subscribe to my newsletter to enhance your .NET skills

Step 1: Enable HttpLogging

Just two simple steps:

1️⃣ Add middleware in Program.cs:

var builder = WebApplication.CreateBuilder(args);

// Enable HTTP logging service
builder.Services.AddHttpLogging(options =>
{
    options.LoggingFields = HttpLoggingFields.Request | HttpLoggingFields.Response;
});

var app = builder.Build();

// Add to HTTP request pipeline
app.UseHttpLogging();

app.Run();

2️⃣ Adjust logging level in appsettings.json:

{
  "Logging":{
    "LogLevel":{
      "Default":"Information",
      "Microsoft.AspNetCore":"Warning",
      "Microsoft.AspNetCore.Hosting.Diagnostics":"Warning",
      "Microsoft.AspNetCore.HttpLogging.HttpLoggingMiddleware":"Information"
    }
  }
}

Example Output:

info: Microsoft.AspNetCore.HttpLogging.HttpLoggingMiddleware[1]
      Request:
      Protocol: HTTP/1.1
      Method: GET
      Scheme: https
      PathBase: 
      Path: /
      Headers:
        Host: localhost:5001
        User-Agent: Mozilla/5.0...
      Response:
      StatusCode: 200
      Headers:
        Content-Type: text/plain; charset=utf-8

⚙️ Advanced Configuration Tips

Custom Logging Fields

builder.Services.AddHttpLogging(options =>
{
    options.LoggingFields = 
        HttpLoggingFields.RequestMethod |
        HttpLoggingFields.RequestPath |
        HttpLoggingFields.RequestQuery |
        HttpLoggingFields.RequestHeaders |
        HttpLoggingFields.ResponseStatusCode |
        HttpLoggingFields.Duration;
});

Limit Recorded Headers

builder.Services.AddHttpLogging(options =>
{
    options.RequestHeaders.Add("X-API-Version");
    options.RequestHeaders.Add("User-Agent");
    options.ResponseHeaders.Add("Content-Type");
});

Environment-Specific Configuration

builder.Services.AddHttpLogging(options =>
{
    // Basic configuration
    options.LoggingFields = ...;
    
    // Log request/response bodies in development environment
    if (builder.Environment.IsDevelopment())
    {
        options.LoggingFields |= HttpLoggingFields.RequestBody | HttpLoggingFields.ResponseBody;
        options.RequestBodyLogLimit = 1024 * 32; // 32 KB
        options.ResponseBodyLogLimit = 1024 * 32;
    }
});

🛠️ Custom Logging with Interceptors

public class CustomLoggingInterceptor : IHttpLoggingInterceptor
{
    public ValueTask OnRequestAsync(HttpLoggingInterceptorContext context)
    {
        // Dynamically remove sensitive headers
        context.HttpContext.Request.Headers.Remove("X-API-Key");
        
        // Add tracking ID
        context.AddParameter("RequestId", Guid.NewGuid().ToString());
        return ValueTask.CompletedTask;
    }

    public ValueTask OnResponseAsync(HttpLoggingInterceptorContext context)
    {
        // Remove sensitive headers like Set-Cookie
        context.HttpContext.Response.Headers.Remove("Set-Cookie");
        return ValueTask.CompletedTask;
    }
}

// Register interceptor
builder.Services.AddSingleton<IHttpLoggingInterceptor, CustomLoggingInterceptor>();

🔐 Endpoint-Level Logging Configuration

// Disable logging for specific endpoint
app.MapGet("/health", () => Results.Ok()).DisableHttpLogging();

// Custom endpoint logging behavior
app.MapPost("/api/orders", (OrderRequest request) => Results.Created())
   .WithHttpLogging(logging =>
   {
       logging.LoggingFields = HttpLoggingFields.RequestBody | HttpLoggingFields.ResponseStatusCode;
   });

🚫 Sensitive Data Redaction Practices

Why Redact?:

• Security Risks: Tokens/passwords in logs can lead to unauthorized access
• Compliance Requirements: Regulations like GDPR/HIPAA mandate protection of sensitive data
• User Trust: Protecting privacy is fundamental to gaining user trust

Solution:

public class SensitiveDataRedactionInterceptor : IHttpLoggingInterceptor
{
    public ValueTask OnRequestAsync(HttpLoggingInterceptorContext context)
    {
        // Redact path
        if (context.TryDisable(HttpLoggingFields.RequestPath))
            context.AddParameter("Path", "[REDACTED]");

        // Redact headers
        foreach (var header in context.HttpContext.Request.Headers)
            context.AddParameter(header.Key, "[REDACTED]");
        
        return ValueTask.CompletedTask;
    }
}

Example of Redacted Logs:

info: Microsoft.AspNetCore.HttpLogging.HttpLoggingMiddleware[1]
      Request:
      Path: [REDACTED]
      Authorization: [REDACTED]
      Method: GET

⚡ Logging HttpClient Requests

public class HttpLoggingHandler : DelegatingHandler
{
    protected override async Task<HttpResponseMessage> SendAsync(
        HttpRequestMessage request, CancellationToken ct)
    {
        // Log request
        var traceId = Guid.NewGuid().ToString();
        _logger.LogDebug($"[REQUEST] {traceId}\n{request.Method}: {request.RequestUri}");

        // Execute request
        var response = await base.SendAsync(request, ct);

        // Log response
        _logger.LogDebug($"[RESPONSE] {traceId}\nStatus: {response.StatusCode}");
        return response;
    }
}

// Register with HttpClient
builder.Services.AddHttpClient<ITodoClient, TodoClient>()
    .AddHttpMessageHandler(provider => 
        new HttpLoggingHandler(provider.GetRequiredService<ILogger>()));