npmpackage.info

Gathering detailed insights and metrics for morgan

Other packages similar to morgan

@lsk4/log

4.26.0

Yet another logger whitch combines the best features of debug, bunyan, logfmt/logrus, morgan/winston

@morgan-stanley/ts-mocking-bird

1.2.4

A fully type safe mocking, call verification and import replacement library for jasmine and jest

@lskjs/log

3.18.0

Yet another logger whitch combines the best features of debug, bunyan, logfmt/logrus, morgan/winston

@myrotvorets/express-request-logger

1.2.2

HTTP request logger middleware for Express

Gathering detailed insights and metrics for morgan

morgan

HTTP request logger middleware for node.js

1.10.0

7,963

MIT

JavaScript

4.77 kB

1,114,414,695 3.5

Installations

npm install morgan

Score

96.1

Supply Chain

99.5

Quality

77.7

Maintenance

100

Vulnerability

100

License

Pull Requests

Open

9

Total

110

Closed

90

Merged

11

Issues

Open

17

Total

174

Closed

157

Releases

1.10.0

Published on 20 Mar 2020

1.9.1

Published on 11 Sept 2018

1.9.0

Published on 27 Sept 2017

1.8.2

Published on 24 May 2017

1.8.1

Published on 11 Feb 2017

1.8.0

Published on 05 Feb 2017

View all 26 releases

Developer

expressjs

Developer Guide

BETA

Module System

Unable to determine the module system for this package.

Min. Node Version

>= 0.8.0

Typescript Support

No

Node Version

13.11.0

NPM Version

6.13.7 Statistics

7,963 Stars

374 Commits

535 Forks

95 Watching

1 Branches

44 Contributors

Updated on 27 Nov 2024

Bundle Size

13.05 kB

Minified

4.77 kB

Minified + Gzipped

Bundlephobia

Languages

JavaScript (100%)

Total Downloads

Cumulative downloads

Total Downloads

1,114,414,695

Last day

-2.3%

1,012,390

Compared to previous day

Last week

2.7%

5,413,664

Compared to previous week

Last month

7.5%

22,319,438

Compared to previous month

Last year

14.8%

234,402,052

Compared to previous year

Daily Downloads

Weekly Downloads

Monthly Downloads

Yearly Downloads

Dependencies

depd debug basic-auth on-headers on-finished

Dev Dependencies

nyc mocha split eslint supertest eslint-plugin-node eslint-plugin-import eslint-plugin-promise eslint-config-standard eslint-plugin-markdown eslint-plugin-standard

Versions

morgan

HTTP request logger middleware for node.js

Named after Dexter, a show you should not watch until completion.

Installation

This is a Node.js module available through the npm registry. Installation is done using the npm install command:

1$ npm install morgan

API

1var morgan = require('morgan')

morgan(format, options)

Create a new morgan logger middleware function using the given format and options. The format argument may be a string of a predefined name (see below for the names), a string of a format string, or a function that will produce a log entry.

The format function will be called with three arguments tokens, req, and res, where tokens is an object with all defined tokens, req is the HTTP request and res is the HTTP response. The function is expected to return a string that will be the log line, or undefined / null to skip logging.

Using a predefined format string

1morgan('tiny')

Using format string of predefined tokens

1morgan(':method :url :status :res[content-length] - :response-time ms')

Using a custom format function

1morgan(function (tokens, req, res) {
2  return [
3    tokens.method(req, res),
4    tokens.url(req, res),
5    tokens.status(req, res),
6    tokens.res(req, res, 'content-length'), '-',
7    tokens['response-time'](req, res), 'ms'
8  ].join(' ')
9})

Options

Morgan accepts these properties in the options object.

immediate

Write log line on request instead of response. This means that a requests will be logged even if the server crashes, but data from the response (like the response code, content length, etc.) cannot be logged.

skip

Function to determine if logging is skipped, defaults to false. This function will be called as skip(req, res).

1// EXAMPLE: only log error responses
2morgan('combined', {
3  skip: function (req, res) { return res.statusCode < 400 }
4})

stream

Output stream for writing log lines, defaults to process.stdout.

Predefined Formats

There are various pre-defined formats provided:

combined

Standard Apache combined log output.

:remote-addr - :remote-user [:date[clf]] ":method :url HTTP/:http-version" :status :res[content-length] ":referrer" ":user-agent"

common

Standard Apache common log output.

:remote-addr - :remote-user [:date[clf]] ":method :url HTTP/:http-version" :status :res[content-length]

dev

Concise output colored by response status for development use. The :status token will be colored green for success codes, red for server error codes, yellow for client error codes, cyan for redirection codes, and uncolored for information codes.

:method :url :status :response-time ms - :res[content-length]

short

Shorter than default, also including response time.

:remote-addr :remote-user :method :url HTTP/:http-version :status :res[content-length] - :response-time ms

tiny

The minimal output.

:method :url :status :res[content-length] - :response-time ms

Tokens

Creating new tokens

To define a token, simply invoke morgan.token() with the name and a callback function. This callback function is expected to return a string value. The value returned is then available as ":type" in this case:

1morgan.token('type', function (req, res) { return req.headers['content-type'] })

Calling morgan.token() using the same name as an existing token will overwrite that token definition.

The token function is expected to be called with the arguments req and res, representing the HTTP request and HTTP response. Additionally, the token can accept further arguments of it's choosing to customize behavior.

:date[format]

The current date and time in UTC. The available formats are:

clf for the common log format ("10/Oct/2000:13:55:36 +0000")
iso for the common ISO 8601 date time format (2000-10-10T13:55:36.000Z)
web for the common RFC 1123 date time format (Tue, 10 Oct 2000 13:55:36 GMT)

If no format is given, then the default is web.

:http-version

The HTTP version of the request.

:method

The HTTP method of the request.

:referrer

The Referrer header of the request. This will use the standard mis-spelled Referer header if exists, otherwise Referrer.

:remote-addr

The remote address of the request. This will use req.ip, otherwise the standard req.connection.remoteAddress value (socket address).

:remote-user

The user authenticated as part of Basic auth for the request.

:req[header]

The given header of the request. If the header is not present, the value will be displayed as "-" in the log.

:res[header]

The given header of the response. If the header is not present, the value will be displayed as "-" in the log.

:response-time[digits]

The time between the request coming into morgan and when the response headers are written, in milliseconds.

The digits argument is a number that specifies the number of digits to include on the number, defaulting to 3, which provides microsecond precision.

:status

The status code of the response.

If the request/response cycle completes before a response was sent to the client (for example, the TCP socket closed prematurely by a client aborting the request), then the status will be empty (displayed as "-" in the log).

:total-time[digits]

The time between the request coming into morgan and when the response has finished being written out to the connection, in milliseconds.

The digits argument is a number that specifies the number of digits to include on the number, defaulting to 3, which provides microsecond precision.

:url

The URL of the request. This will use req.originalUrl if exists, otherwise req.url.

:user-agent

The contents of the User-Agent header of the request.

morgan.compile(format)

Compile a format string into a format function for use by morgan. A format string is a string that represents a single log line and can utilize token syntax. Tokens are references by :token-name. If tokens accept arguments, they can be passed using [], for example: :token-name[pretty] would pass the string 'pretty' as an argument to the token token-name.

The function returned from morgan.compile takes three arguments tokens, req, and res, where tokens is object with all defined tokens, req is the HTTP request and res is the HTTP response. The function will return a string that will be the log line, or undefined / null to skip logging.

Normally formats are defined using morgan.format(name, format), but for certain advanced uses, this compile function is directly available.

Examples

express/connect

Sample app that will log all request in the Apache combined format to STDOUT

1var express = require('express')
2var morgan = require('morgan')
3
4var app = express()
5
6app.use(morgan('combined'))
7
8app.get('/', function (req, res) {
9  res.send('hello, world!')
10})

vanilla http server

Sample app that will log all request in the Apache combined format to STDOUT

1var finalhandler = require('finalhandler')
2var http = require('http')
3var morgan = require('morgan')
4
5// create "middleware"
6var logger = morgan('combined')
7
8http.createServer(function (req, res) {
9  var done = finalhandler(req, res)
10  logger(req, res, function (err) {
11    if (err) return done(err)
12
13    // respond to request
14    res.setHeader('content-type', 'text/plain')
15    res.end('hello, world!')
16  })
17})

write logs to a file

single file

Sample app that will log all requests in the Apache combined format to the file access.log.

1var express = require('express')
2var fs = require('fs')
3var morgan = require('morgan')
4var path = require('path')
5
6var app = express()
7
8// create a write stream (in append mode)
9var accessLogStream = fs.createWriteStream(path.join(__dirname, 'access.log'), { flags: 'a' })
10
11// setup the logger
12app.use(morgan('combined', { stream: accessLogStream }))
13
14app.get('/', function (req, res) {
15  res.send('hello, world!')
16})

log file rotation

Sample app that will log all requests in the Apache combined format to one log file per day in the log/ directory using the rotating-file-stream module.

1var express = require('express')
2var morgan = require('morgan')
3var path = require('path')
4var rfs = require('rotating-file-stream') // version 2.x
5
6var app = express()
7
8// create a rotating write stream
9var accessLogStream = rfs.createStream('access.log', {
10  interval: '1d', // rotate daily
11  path: path.join(__dirname, 'log')
12})
13
14// setup the logger
15app.use(morgan('combined', { stream: accessLogStream }))
16
17app.get('/', function (req, res) {
18  res.send('hello, world!')
19})

split / dual logging

The morgan middleware can be used as many times as needed, enabling combinations like:

Log entry on request and one on response
Log all requests to file, but errors to console
... and more!

Sample app that will log all requests to a file using Apache format, but error responses are logged to the console:

1var express = require('express')
2var fs = require('fs')
3var morgan = require('morgan')
4var path = require('path')
5
6var app = express()
7
8// log only 4xx and 5xx responses to console
9app.use(morgan('dev', {
10  skip: function (req, res) { return res.statusCode < 400 }
11}))
12
13// log all requests to access.log
14app.use(morgan('common', {
15  stream: fs.createWriteStream(path.join(__dirname, 'access.log'), { flags: 'a' })
16}))
17
18app.get('/', function (req, res) {
19  res.send('hello, world!')
20})

use custom token formats

Sample app that will use custom token formats. This adds an ID to all requests and displays it using the :id token.

1var express = require('express')
2var morgan = require('morgan')
3var uuid = require('node-uuid')
4
5morgan.token('id', function getId (req) {
6  return req.id
7})
8
9var app = express()
10
11app.use(assignId)
12app.use(morgan(':id :method :url :response-time'))
13
14app.get('/', function (req, res) {
15  res.send('hello, world!')
16})
17
18function assignId (req, res, next) {
19  req.id = uuid.v4()
20  next()
21}

License

MIT

Stable Version

The latest stable version of the package.

Stable Version

1.10.0

CRITICAL

9.8/10

Summary

Code Injection in morgan

Affected Versions

< 1.9.1

Fuzzing

Determines if the project uses fuzzing.

Reason

project is not fuzzed

Details

Warn: no OSSFuzz integration found: Follow the steps in https://github.com/google/oss-fuzz to integrate fuzzing for your project. Over time, try to add fuzzing for more functionalities of your project. (High effort)
Warn: no OneFuzz integration found: Follow the steps in https://github.com/microsoft/onefuzz to start fuzzing for your project. Over time, try to add fuzzing for more functionalities of your project. (High effort)
Warn: no GoBuiltInFuzzer integration found: Follow the steps in https://go.dev/doc/fuzz/ to enable fuzzing on your project. Over time, try to add fuzzing for more functionalities of your project. (Medium effort)
Warn: no PythonAtherisFuzzer integration found: Follow the steps in https://github.com/google/atheris to enable fuzzing on your project. Over time, try to add fuzzing for more functionalities of your project. (Medium effort)
Warn: no CLibFuzzer integration found: Follow the steps in https://llvm.org/docs/LibFuzzer.html to enable fuzzing on your project. Over time, try to add fuzzing for more functionalities of your project. (Medium effort)
Warn: no CppLibFuzzer integration found: Follow the steps in https://llvm.org/docs/LibFuzzer.html to enable fuzzing on your project. Over time, try to add fuzzing for more functionalities of your project. (Medium effort)
Warn: no SwiftLibFuzzer integration found: Follow the steps in https://google.github.io/oss-fuzz/getting-started/new-project-guide/swift-lang/ to enable fuzzing on your project. Over time, try to add fuzzing for more functionalities of your project. (Medium effort)
Warn: no RustCargoFuzzer integration found: Follow the steps in https://rust-fuzz.github.io/book/cargo-fuzz.html to enable fuzzing on your project. Over time, try to add fuzzing for more functionalities of your project. (Medium effort)
Warn: no JavaJazzerFuzzer integration found: Follow the steps in https://github.com/CodeIntelligenceTesting/jazzer to enable fuzzing on your project. Over time, try to add fuzzing for more functionalities of your project. (Medium effort)
Warn: no ClusterFuzzLite integration found: Follow the steps in https://github.com/google/clusterfuzzlite to integrate fuzzing as part of CI. Over time, try to add fuzzing for more functionalities of your project. (High effort)
Warn: no HaskellPropertyBasedTesting integration found: Use one of the following frameworks to fuzz your project: QuickCheck: https://hackage.haskell.org/package/QuickCheck hedgehog: https://hedgehog.qa/ validity: https://github.com/NorfairKing/validity smallcheck: https://hackage.haskell.org/package/smallcheck hspec: https://hspec.github.io/ tasty: https://hackage.haskell.org/package/tasty (High effort)
Warn: no TypeScriptPropertyBasedTesting integration found: Use fast-check: https://github.com/dubzzz/fast-check (High effort)
Warn: no JavaScriptPropertyBasedTesting integration found: Use fast-check: https://github.com/dubzzz/fast-check (High effort)

0

Maintained

Determines if the project is "actively maintained".

0

SAST

Determines if the project uses static code analysis.

0

Security-Policy

Determines if the project has published a security policy.

Reason

security policy file not detected

Details

Warn: no security policy file detected: On GitHub: Enable private vulnerability disclosure in your repository settings https://docs.github.com/en/code-security/security-advisories/repository-security-advisories/configuring-private-vulnerability-reporting-for-a-repository Add a section in your SECURITY.md indicating you have enabled private reporting, and tell them to follow the steps in https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability to report vulnerabilities. On GitLab: Add a section in your SECURITY.md indicating the process to disclose vulnerabilities for your project. Examples: https://github.com/ossf/scorecard/blob/main/SECURITY.md, https://github.com/slsa-framework/slsa-github-generator/blob/main/SECURITY.md, https://github.com/sigstore/.github/blob/main/SECURITY.md. For additional information on vulnerability disclosure, see https://github.com/ossf/oss-vulnerability-guide/blob/main/maintainer-guide.md. (Medium effort)
Warn: no security file to analyze: On GitHub: Enable private vulnerability disclosure in your repository settings https://docs.github.com/en/code-security/security-advisories/repository-security-advisories/configuring-private-vulnerability-reporting-for-a-repository Add a section in your SECURITY.md indicating you have enabled private reporting, and tell them to follow the steps in https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability to report vulnerabilities. On GitLab: Provide a point of contact in your SECURITY.md. Examples: https://github.com/ossf/scorecard/blob/main/SECURITY.md, https://github.com/slsa-framework/slsa-github-generator/blob/main/SECURITY.md, https://github.com/sigstore/.github/blob/main/SECURITY.md. (Low effort)
Warn: no security file to analyze: On GitHub: Enable private vulnerability disclosure in your repository settings https://docs.github.com/en/code-security/security-advisories/repository-security-advisories/configuring-private-vulnerability-reporting-for-a-repository Add a section in your SECURITY.md indicating you have enabled private reporting, and tell them to follow the steps in https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability to report vulnerabilities. On GitLab: Add a section in your SECURITY.md indicating the process to disclose vulnerabilities for your project. Examples: https://github.com/ossf/scorecard/blob/main/SECURITY.md, https://github.com/slsa-framework/slsa-github-generator/blob/main/SECURITY.md, https://github.com/sigstore/.github/blob/main/SECURITY.md. (Low effort)
Warn: no security file to analyze: On GitHub: Enable private vulnerability disclosure in your repository settings https://docs.github.com/en/code-security/security-advisories/repository-security-advisories/configuring-private-vulnerability-reporting-for-a-repository Add a section in your SECURITY.md indicating you have enabled private reporting, and tell them to follow the steps in https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing/privately-reporting-a-security-vulnerability to report vulnerabilities. On GitLab: Add a section in your SECURITY.md indicating the process to disclose vulnerabilities for your project. Examples: https://github.com/ossf/scorecard/blob/main/SECURITY.md, https://github.com/slsa-framework/slsa-github-generator/blob/main/SECURITY.md, https://github.com/sigstore/.github/blob/main/SECURITY.md. (Low effort)

0

Token-Permissions

Determines if the project's workflows follow the principle of least privilege.

Score

3.5

/10

Last Scanned on 2024-11-25T21:23:56Z

The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.

Learn More