$ show expressjs/morgan
Morgan is a production-grade HTTP request logger middleware for Node.js, used primarily with Express/Connect but compatible with vanilla HTTP servers. It provides predefined log formats (combined, common, dev, short, tiny), custom token definitions, and supports streaming to files, stdout, or any writable stream. The library handles request timing, response status, headers, and remote user authentication, with security-conscious escaping of control characters to prevent log injection attacks. Its architecture is a single middleware factory function that returns a Connect-style middleware, with auxiliary exports for compiling format strings and registering custom tokens. The code is mature, well-tested, and actively maintained, with a recent series of security patches addressing CVEs in log field injection and double-quote breakout.
The LLM identified 2 files worth highlighting for reuse:
A 30-line private function that escapes control characters (0x00-0x1F, 0x7F-0x9F, Unicode line/paragraph separators, backslash, and double-quote) into JSON-style escape sequences. It is self-contained with zero internal dependencies, making it directly reusable in any JavaScript project that requires safe serialization of user-controlled values into line-oriented logs or structured output.
The compile() function parses a format string containing :token and :token[arg] placeholders and generates a JavaScript function that evaluates them at log time. It uses a regex to replace tokens with code stubs, then instantiates the function via `new Function`. This pattern can be extracted and adapted for any system that needs runtime compiled string templates with pluggable variable resolution (e.g., log formats, metric tags).