added masking key in log with special <hidden> value

log_helpers.go

@@ -8,15 +8,23 @@ import (
 	"github.com/TykTechnologies/tyk/config"
 )
 
+// identifies that field value was hidden before output to the log
+const (
+	logHiddenValue = "<hidden>"
+)
+
 func getLogEntryForRequest(r *http.Request, key string, data map[string]interface{}) *logrus.Entry {
 	// populate http request fields
 	fields := logrus.Fields{
 		"path":   r.URL.Path,
 		"origin": requestIP(r),
 	}
 	// add key to log if configured to do so
-	if key != "" && config.Global.EnableKeyLogging {
+	if key != "" {
 		fields["key"] = key
+		if !config.Global.EnableKeyLogging {
+			fields["key"] = logHiddenValue
+		}
 	}
 	// add to log additional fields if any passed
 	if data != nil && len(data) > 0 {

log_helpers_test.go

@@ -72,6 +72,7 @@ func TestGetLogEntryForRequest(t *testing.T) {
 			Result: logrus.WithFields(logrus.Fields{
 				"path":   "/test",
 				"origin": "127.0.0.1",
+				"key":    logHiddenValue,
 			}),
 		},
 		// enable_key_logging is not set, key is not passed, no additional data field
@@ -94,6 +95,7 @@ func TestGetLogEntryForRequest(t *testing.T) {
 				"origin": "127.0.0.1",
 				"a":      1,
 				"b":      "test",
+				"key":    logHiddenValue,
 			}),
 		},
 		// enable_key_logging is not set, key is not passed, additional data fields are passed