Correlation IDs are propagated through requests

NIST AU-3 requires that audit records contain sufficient information to establish the source and outcome of logged events — and when a single user request spans multiple log entries across middleware, API handlers, and database calls, a correlation ID is the thread that ties them together. Without it, debugging a reported user error requires manual timestamp correlation across log entries that may have subsecond overlaps with other concurrent requests. The practical impact: an investigation that takes 5 minutes with correlation IDs takes 30–60 minutes without them. OWASP A09 identifies insufficient log context as a monitoring failure; a request ID is the minimum contextual field that turns a pile of log lines into a traceable sequence.

Generate a UUID per incoming request in middleware and propagate it to all log entries for that request.

In middleware.ts:

import { NextResponse } from 'next/server'
import { randomUUID } from 'crypto'

export function middleware(req: NextRequest) {
  const requestId = req.headers.get('x-request-id') ?? randomUUID()
  const res = NextResponse.next()
  res.headers.set('x-request-id', requestId)
  return res
}

Then in API route handlers, read the header and include it in every log entry:

const requestId = request.headers.get('x-request-id')
logger.info({ requestId, userId }, 'Processing payment')
logger.error({ requestId, err, userId }, 'Payment failed')

If you're using Sentry with OpenTelemetry, trace IDs are automatically injected — check whether your log entries already include a sentry.trace or traceId field before implementing a manual approach.