Hide access tokens from logs

src/server.js

@@ -49,7 +49,16 @@ function initializeExpressSync() {
     app.enable('trust proxy');
 
     if (process.env.BOX_ENV !== 'test') {
-        app.use(middleware.morgan('Box :method :url :status :response-time ms - :res[content-length]', {
+        app.use(middleware.morgan(function (tokens, req, res) {
+            return [
+                'Box',
+                tokens.method(req, res),
+                tokens.url(req, res).replace(/(access_token=)[^\&]+/, '$1' + '<redacted>'),
+                tokens.status(req, res),
+                tokens['response-time'](req, res), 'ms', '-',
+                tokens.res(req, res, 'content-length')
+            ].join(' ');
+        }, {
             immediate: false,
             // only log failed requests by default
             skip: function (req, res) { return res.statusCode < 400; }