[API Proposal]: Http.Diagnostics should log destination IP address on request failure
- Dominant language
- C#
- Stars
- 3.2k
- Forks
- 894
- Avg merge
- 1d 12h
- Merged PRs (30d)
- 23
Description
### Background and motivation
Customers can isolate HTTP traffic using Network Security Groups (NSG). Identifying outbound request failures due to IPs blocked by NSG outbound rules is difficult. Capturing destination IPs on failed requests will help reduce time to diagnose.
### API Proposal
We introduce two properties. One controls whether to log destination IP address or not, the other specifies a data class used to redact the destination IP address.
```diff
namespace Microsoft.Extensions.Http.Logging;
///
/// Options to configure HTTP client requests logging.
///
public class LoggingOptions
{
+ ///
+ /// Gets or sets a value indicating whether to log destination IP address on request failure or not.
+ ///
+ ///
+ /// Default set to .
+ /// When enabled, the redacted destination IP address will be logged on request failure.
+ ///
+ public bool LogDestinationIpAddress { get; set; }
+
+ ///
+ /// Gets or sets a value indicating a data class used to redact the destination IP address.
+ ///
+ ///
+ /// Default set to .
+ /// When destination IP address logging is enabled, you must specify a data class other than
+ /// to ensure the destination IP address is properly redacted.
+ ///
+ public DataClassification DestinationIpAddressDataClass { get; set; } = DataClassification.None;
}
```
And we'll register a tag name of the new property being logged:
```diff
namespace Microsoft.Extensions.Http.Logging;
///
/// Constants used for HTTP client logging tags.
///
public static class HttpClientLoggingTagNames
{
+ ///
+ /// Host IP Address.
+ ///
+ public const string DestinationIpAddress = "server.ipaddress";
}
```
### API Usage
```csharp
services
.AddHttpClient("client")
.AddExtendedHttpClientLogging(options =>
{
options.LogDestinationIpAddress = true;
options.DestinationIpAddressDataClass = EnterpriseDataClassification.PrivateData;
});
services.AddRedaction(builder =>
{
builder.SetRedactor(new DataClassificationSet(EnterpriseDataClassification.PrivateData));
});
```
### Risks
IP addresses are considered privacy-sensitive data. To prevent customers from logging unredacted IP addresses, we will implement validation logic that requires the data class to be set to a value other than 'None' when destination IP address logging is enabled.
### Alternative Designs
Instead of two properties we introduce a single property setting a data class for the destination IP address and controlling whether to log it or not.
```diff
namespace Microsoft.Extensions.Http.Logging;
///
/// Options to configure HTTP client requests logging.
///
public class LoggingOptions
{
+ ///
+ /// Gets or sets a value indicating a data class used to redact the destination IP address.
+ ///
+ ///
+ /// Default set to .
+ /// To enable destination IP address logging, you must specify a data class other than
+ /// to ensure the destination IP address is redacted.
+ ///
+ public DataClassification DestinationIpAddressDataClass { get; set; } = DataClassification.None;
}
```
Contributor guide
Assessment
This issue has not been assessed yet.