HttpLogging exclude redacted headers from logging

[ramil-mux]

I want to log my http request and response, but i want log only body and only my headers.
For example, i don't want log Accept header, or Connection header, i want log only X-USER-ID header. Today, if I choose LoggingFields = HttpLoggingFields.RequestBody | HttpLoggingFields.RequestHeaders; i see in logs headers with Redacted value. I want to exclude them from log.
How can i do this scenario?

Using .NET 9

[BrennanConroy]

Removing the "[Redacted]" log isn't a first class feature currently.
You can workaround this by using the following code and CombineLogs = true in HttpLoggingOptions

builder.Services.AddHttpLogging(o =>
{
    o.LoggingFields = Microsoft.AspNetCore.HttpLogging.HttpLoggingFields.RequestHeaders;
    o.RequestHeaders.Remove("Accept");
    o.CombineLogs = true;
});

builder.Services.AddSingleton<IHttpLoggingInterceptor>(new CustomInterceptor());

public class CustomInterceptor : IHttpLoggingInterceptor
{
    public ValueTask OnRequestAsync(HttpLoggingInterceptorContext logContext)
    {
        return default;
    }

    public ValueTask OnResponseAsync(HttpLoggingInterceptorContext logContext)
    {
        logContext.Parameters.Remove(new ("Accept", "[Redacted]"));
        return default;
    }
}

But I think we'd be open to making this easier.

[halter73]

I wonder if we could delay when the IHttpLoggingInterceptor gets called so you could do what @BrennanConroy suggests in OnRequestAsync without needing to set CombineLogs = true. It'd technically be breaking, but I think it would only matter if you mutate logContext.Parameters, and the only real consequence would be that custom parameters get logged later.

We could also consider adding a bool HttpLoggingOptions.OmitRedactedLogs { get; set; } property.

I'm putting this is the backlog for now, but if we see enough interest, we're open to this kind of change.

[ramil-mux]

@halter73 @BrennanConroy Thank you for your answers! My workaround:

builder.Services.AddHttpLogging(o =>
{
    o.LoggingFields = HttpLoggingFields.RequestHeaders | 
                      HttpLoggingFields.RequestBody |
                      HttpLoggingFields.ResponseHeaders |
                      HttpLoggingFields.ResponseBody;
    o.RequestHeaders.Add("Authorization");
    o.RequestHeaders.Add("pos");
    o.RequestHeaders.Add("X-Correlation-Token");
});
builder.Services.AddHttpLoggingInterceptor<LogInterceptor>();

public class LogInterceptor : IHttpLoggingInterceptor
{
    private static readonly HashSet<string> Headers =
    [
        "Authorization",
        "Pos",
        "X-Correlation-Token",
        "Content-Type"
    ];

    public ValueTask OnRequestAsync(HttpLoggingInterceptorContext logContext) =>
        CheckHeaders(logContext.HttpContext.Request.Headers);

    public ValueTask OnResponseAsync(HttpLoggingInterceptorContext logContext) =>
        CheckHeaders(logContext.HttpContext.Response.Headers);

    private static ValueTask CheckHeaders(IHeaderDictionary headers)
    {
        foreach (var header in headers)
            if (!Headers.Contains(header.Key))
                headers[header.Key] = StringValues.Empty;

        return ValueTask.CompletedTask;
    }
}

Yes the size of the request and response body is much larger than the size of the headers, but the headers create information noise in the logs. For example, one request can contain about 15-20 headers. Half of them are system ones and we don't want to see them