Log Level for HTTP Requests

Direct Answer

There is no universal rule that every HTTP request belongs at INFO. Use a dedicated access-log or structured request event according to traffic, audit, privacy, and cost needs; high-volume success traffic may be sampled or kept at a lower level. Record failures at a level that reflects their meaning, and never log credentials, tokens, sensitive headers, or unredacted bodies.

Code Example

import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.web.servlet.HandlerInterceptor;

public class RequestLogInterceptor implements HandlerInterceptor {
    private static final Logger log = LoggerFactory.getLogger(RequestLogInterceptor.class);

    public boolean preHandle(HttpServletRequest req, HttpServletResponse res, Object handler) {
        req.setAttribute("start", System.currentTimeMillis());
        return true;
    }
    public void afterCompletion(HttpServletRequest req, HttpServletResponse res, Object h, Exception e) {
        long ms = System.currentTimeMillis() - (long) req.getAttribute("start");
        // Metadata only — never the body or auth header
        log.info("{} {} -> {} ({} ms)", req.getMethod(), req.getRequestURI(), res.getStatus(), ms);
    }
}

Common Mistakes & Pitfalls

• Requests at ERROR: treating normal traffic as errors, making ERROR meaningless and paging people for routine load.
• DEBUG left on in prod: enabling logging.level.org.springframework.web=DEBUG to chase one bug and forgetting it, dumping every header and param — including secrets.
• No redaction: logging whole request objects with password or creditCard fields, a security and compliance violation.