Direct answer
Define the events and fields needed for a security decision, then avoid logging secrets and unnecessary personal data. Restrict access, set retention and verify that masking works without making incidents impossible to investigate.
Identify useful events
An authentication service may need event time, outcome, account identifier and correlation ID for incident review. Agree with security and privacy owners which fields are required and who can access them. Collecting a full request body is not automatically necessary.
Reference: NIST SP 800-61 Rev. 3: Incident Response.
Remove high-risk values
Avoid logging passwords, bearer tokens, session cookies and sensitive reset links. For an API error, a correlation ID and sanitized route may be enough to connect the event to a restricted request record without storing an active credential.
- Review application, proxy and error logs.
- Mask sensitive fields before data leaves the service where practical.
- Document who can view and export logs.
Test usefulness and masking
Use synthetic credentials and test records to verify that logs contain the event and context needed while secrets do not appear. Check unusual error paths and third-party telemetry as well as normal requests. Do not introduce real secrets to test masking.
Reference: NIST SP 800-61 Rev. 3: Incident Response.
Set retention and response
Agree retention, access review and deletion with the relevant owners. If a secret was already logged, restrict access and follow incident and credential-rotation procedures; changing the logging code does not revoke the credential or erase every copy.
Assessment limits
Log minimization must be balanced with investigation and legal requirements. Masking can fail in unexpected paths, and retention policies vary by system and jurisdiction.
Frequently asked questions
Should all identifiers be removed?
Not necessarily. Keep only the identifiers needed for authorized investigation, protected according to policy.
Does deleting a log revoke a leaked token?
No. Treat the token as potentially exposed and use the provider's revocation process.
Primary sources and further reading
These guides combine published security guidance with practical assessment planning. Adapt checks to the owner's policy, environment, and authorized scope.
This guide was prepared with AI assistance using the linked sources and illustrative examples. Check current vendor guidance and your environment before making changes.