Hands-On Software Engineering with Golang

The devil is in the (logging) details

When using structured logging, it is very easy to get carried away and try to stuff as much information as possible into the key-value pairs. Unfortunately, this can often prove to be dangerous security-wise! Take a look at the following code snippet, which retrieves a user's data from a URL they have provided to us:

func fetchUserData(url *url.URL) (*user.Data, error) {
    tick := time.Now()
    res, err := http.Get(url.String())
    if err != nil {
        return nil, err
    }
    defer func() { _ = res.Body.Close() }()

    logrus.WithFields(logrus.Fields{
        "url":  url,
        "time": time.Since(tick).String(),
    }).Info("retrieved user data")

    // omitted: read and unmarshal user data
}

Whenever we succeed in fetching the data, we log an