Squid HTTP Header Logging with log_mime_hdrs

Choose the known transaction and header question before enabling broad capture. If only one field matters, a narrowly selected custom log field may be enough.

For Squid 6 and 7, the documented broad option is:

log_mime_hdrs on

In native and httpd-emulated access formats, this adds two encoded bracketed fields containing request and response headers at the end of each record. Account for the new fields in any parser. Custom log formats have their own header selections; do not assume the same field-count change.

Use a short diagnostic window, restrict access and remove the temporary capture under the service's retention rules. Headers can contain cookies, authorization and application identifiers. Encoding makes them parseable, not harmless.

For ordinary CONNECT, the visible headers include the outer request and reply. The website's subsequent HTTP headers remain inside TLS, so this setting does not reveal its page cookies. For headers received at a controlled origin, observe the request at the destination instead.

The directive reference lists Squid 7 and earlier and excludes Squid 8. Apply it only to a supported installed version rather than treating an old configuration line as a later-release interface.