Truncate "Request.Header.FirstLine" before first appearance of "?"

[holger_haas]

Hello,

we currently write "Request.Header.FirstLine" to our access log.

This is becoming a problem, because the often very long session information consumes more (disk) space then the rest of the entry, and security department has concerns about leakage of sensitive data.

To address this, I would like to truncate the line before the beginning of the "query" part (i.e. first appearance of "?").

So far, this works with 

String.ReplaceIfEquals (String.ReplaceFirstMatch (Request.Header.FirstLine, regex(\?.*), "?TRUNCATED"), "", "-")

But then every single log entry has to be parsed with a Regular Expression (I tried wildcard "\?*", but that did not work), which I fear wil be resource intensive.

Is their a smarter way to achieve this?

Best Regards,

Holger

[Former Member · Accepted solution]

Hi Holger,

Apparently the Community doesnt like the text in my replies.... so here is an awesome screenshot of what I wrote..

Best Regards,

Jon

[holger_haas]

Hello Jon,

I realized that that URL.path sometimes includes newlines. I wonder how that is possible, as these are no valid URLs, at least not properly encoded.

Would "String.URLEncode" help in this case or do I have to use my RegEx solution after all?

Best Regards,

Holger

[btlyric]

Every URL that goes through our proxies gets run through at least one regex. It might not be as onerous on the system as you fear.

On the other hand, since we went to 7.5, I do see increased load on the systems that I haven't yet had the time to track down so your mileage may vary...

BTL

[holger_haas]

Hello Jon,

great, thank you. Works fine and does not truncate the protocol version like my solution did 😞

Best Regards,

Holger