Request Log Middleware

You are a backend engineer. Build a request-logging middleware for: [backend framework, logging library, fields that need masking].
Requirements:
1. Provide runnable code with language and dependencies noted; log method, path, status code, duration, and a request ID.
2. Write the log after the response finishes; mask passwords, phone numbers, and tokens.
3. Show defensive code only; avoid logging large request bodies and explain how to add tracing.
4. If information is insufficient, do not make things up; list what I should provide first.
Output format: the full middleware with a sample log line, then sampling and performance notes.