ASP.NET Core Web API Interview Question #132

What information should not be written to API logs?

Error Handling, Logging, Caching, Rate Limiting, CORS & Reliability Senior Advanced

Quick Interview Answer

Avoid logging passwords, access tokens, refresh tokens, private keys, connection strings, payment secrets, and unnecessary personal or confidential information. Request and response bodies can also contain sensitive data and should not be logged indiscriminately.

Detailed Explanation

Logging policies should support privacy, security, retention, and compliance requirements while still providing enough operational context to diagnose failures.

Code Example

// Avoid:
_logger.LogInformation("Token: {Token}", accessToken);

// Prefer safe identifiers:
_logger.LogInformation(
    "Authentication failed for request {TraceId}",
    HttpContext.TraceIdentifier);