auth: log rejected bearer token attempts #522

New issue

Open

opened 2026-08-04 11:35:24 +00:00 by the.auditor · 0 comments

the.auditor commented

2026-08-04 11:35:24 +00:00

Owner

In internal/auth/auth.go, Middleware.Require() returns 401 for missing and invalid tokens but never logs the rejection. Failed authentication attempts are invisible in logs, hurting observability for brute-force or recon.

Context: PR #521 (internal/auth/auth.go:64).

Suggested fix: log at warn/debug level via the centralized logger (or pass a logger into the middleware), distinguishing missing vs invalid token.

In `internal/auth/auth.go`, `Middleware.Require()` returns 401 for missing and invalid tokens but never logs the rejection. Failed authentication attempts are invisible in logs, hurting observability for brute-force or recon. Context: PR #521 (`internal/auth/auth.go:64`). Suggested fix: log at warn/debug level via the centralized logger (or pass a logger into the middleware), distinguishing missing vs invalid token.

the.auditor added the

Kind/Enhancement

Priority

Medium

labels

2026-08-04 11:35:33 +00:00