
Security News
npm Adopts OIDC for Trusted Publishing in CI/CD Workflows
npm now supports Trusted Publishing with OIDC, enabling secure package publishing directly from CI/CD workflows without relying on long-lived tokens.
EWL provides common defaults for logging in an express application using winston.
EWL (express-winston-logger) provides common defaults for logging in an express application using winston. It is pre-configured with request tracing enabled and extends some of the features provided by express-winston, e.g. body blacklisting redaction.
yarn add ewl
import { Ewl } from 'ewl';
const ewl = new Ewl();
ewl.debug('This logs to the console by default.');
index.ts
:
import { Application } from 'express';
import { ewl, initEwl } from './logger';
const app = express() as Application;
initEwl(app);
const port = 3000;
app.listen(port, () => {
ewl.debug(`App: Listening on port ${port}!`);
});
logger/index.ts
:
import { Application } from 'express';
import { Ewl, LogLevel } from 'ewl';
export let ewl: Ewl;
export function initEwl(app: Application): void {
ewl = new Ewl({
enableRequestLogging: true,
environment: process.env.ENVIRONMENT || 'development',
label: 'app',
logLevel: (process.env.LOG_LEVEL as LogLevel) || 'error',
useLogstashFormat: false,
version: process.env.VERSION || 'unknown',
});
// Use context middleware to inject the request id.
app.use(ewl.contextMiddleware);
// Use request middleware to inject express metadata.
app.use(ewl.requestMiddleware);
}
main.ts
:
import { NestFactory } from '@nestjs/core';
import { Ewl, LogLevel } from 'ewl';
import { AppModule } from './app.module';
async function bootstrap() {
const ewl = new Ewl({
enableRequestLogging: true,
environment: process.env.ENVIRONMENT || 'development',
label: 'app',
logLevel: (process.env.LOG_LEVEL as LogLevel) || 'error',
useLogstashFormat: false,
version: process.env.VERSION || 'unknown',
});
// Set the default NestJS logger, allowing EWL to be the proxy.
const app = await NestFactory.create(AppModule, { logger: ewl });
// Use context middleware to inject the request id.
app.use(ewl.contextMiddleware);
// Use request middleware to inject express metadata.
app.use(ewl.requestMiddleware);
ewl.debug('Starting application on localhost:3000');
await app.listen(3000, 'localhost');
}
bootstrap();
express-winston
Request Logger Middlewareconst ewl = new Ewl({
enableRequestLogging: false,
requestLoggingOptions: {
bodyBlacklist: ['accessToken', 'password', 'refreshToken'],
colorize: true,
expressFormat: true,
headerBlacklist: ['cookie', 'token'],
meta: true,
metaField: 'express',
requestWhitelist: ['body', 'headers', 'method', 'params', 'query', 'url'],
responseWhitelist: ['body', 'headers', 'statusCode'],
statusLevels: true,
},
});
// Use request middleware to inject express metadata.
app.use(ewl.requestMiddleware);
MIT License
Contributions are encouraged, please see further details below:
Here are some basic rules to follow to ensure timely addition of your request:
main
branch. Any other branch (unless specified by the
maintainers) will get rejected.FAQs
EWL provides common defaults for logging in an express application using winston.
The npm package ewl receives a total of 3 weekly downloads. As such, ewl popularity was classified as not popular.
We found that ewl demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
npm now supports Trusted Publishing with OIDC, enabling secure package publishing directly from CI/CD workflows without relying on long-lived tokens.
Research
/Security News
A RubyGems malware campaign used 60 malicious packages posing as automation tools to steal credentials from social media and marketing tool users.
Security News
The CNA Scorecard ranks CVE issuers by data completeness, revealing major gaps in patch info and software identifiers across thousands of vulnerabilities.