Request logging captures method, path, status, and duration

NIST AU-2 requires logging of events sufficient to support incident investigation; PCI-DSS Req 10.2 specifically mandates logging of all access to audit trails and system components, including HTTP method, status, and timing. Without request-level logs capturing method, path, status code, and duration, you cannot answer the most basic production questions: which endpoints are returning 500s, which are slow, and whether a latency spike started before or after a deploy. OWASP A09 identifies the absence of request logging as a direct enabler of undetected attacks — repeated 401s, scan patterns, and error spikes are invisible without a request log stream. Application-level logs that capture only business logic events are insufficient.

Add request logging at the middleware layer so every API call is recorded with method, path, status, and duration — regardless of whether individual handlers log anything.

For Next.js App Router, add to middleware.ts:

import { NextResponse } from 'next/server'
import type { NextRequest } from 'next/server'

export function middleware(req: NextRequest) {
  const start = Date.now()
  const res = NextResponse.next()
  // Use a Vercel log drain or edge logger here in production
  console.log(JSON.stringify({
    method: req.method,
    path: req.nextUrl.pathname,
    status: res.status,
    duration: Date.now() - start
  }))
  return res
}

For Express or Fastify, use morgan or fastify.addHook('onResponse', ...). If you're on Vercel and already using a log drain (Better Stack, Axiom), request logs are captured automatically from stdout — just ensure your handlers emit them.