The example trusts and propagates a client-supplied request ID
Source references: 3The middleware accepts any `x-request-id`, places it in logging context and the response, and the guide calls for downstream propagation, without format, length, uniqueness, or trusted-source validation.
A requester could reuse or forge an ID so unrelated events appear together during incident investigation. Oversized or unusual values could also amplify processing problems in logs, queue metadata, or downstream headers.
The guide makes correlation IDs mandatory, and its example directly accepts a client-supplied `x-request-id`, places it in log context and the response, then calls for propagation across downstream boundaries. If copied without validation elsewhere, an attacker could supply oversized, malformed, or reused IDs that pollute logs, confuse request attribution, and carry untrusted data downstream. This is an example rather than a complete implementation, so validation cannot be proven absent; users can ask for explicit length, character-set, trust-boundary, and regeneration rules.
**Correlation IDs are mandatory.** Generate (or accept) a request ID at the system boundary and attach it to every log line, span, and outbound call. Without it, you cannot reconstruct a single request from interleaved logs:```typescript// Express: child logger per request, ID propagated downstreamapp.use((req, res, next) => { req.id = req.headers['x-request-id'] ?? crypto.randomUUID(); req.log = logger.child({ requestId: req.id }); res.setHeader('x-request-id', req.id); next();Show 2 other places
Both fields have to cross the same boundaries as the correlation ID — queue metadata, HTTP headers — or a worker re-derives the entry point and guesses. A field that merely correlates with an entry point is a hint, not an attribution: anything that can invoke the job can reproduce it.// Express: child logger per request, ID propagated downstreamapp.use((req, res, next) => { req.id = req.headers['x-request-id'] ?? crypto.randomUUID(); req.log = logger.child({ requestId: req.id }); res.setHeader('x-request-id', req.id); next();});