A09 Security Logging and Alerting Failures

def login(email, password):
    print(f"login attempt {email} / {password}")          # secreto en el log, posible inyección de saltos de línea
    user = authenticate(email, password)
    if not user:
        return None                                        # fallo no registrado
    return user

console.log("login failed for " + req.body.email + " with token " + req.headers.authorization);

import json, logging
log = logging.getLogger("security")

def event(action, outcome, **fields):
    log.info(json.dumps({"action": action, "outcome": outcome, **fields}))   # json.dumps hace escape de los saltos de línea

def login(email, password, ip, request_id):
    user = authenticate(email, password)
    if not user:
        event("login", "failure", email=email, ip=ip, request_id=request_id)   # sin contraseña, sin token
        return None
    event("login", "success", user_id=user.id, ip=ip, request_id=request_id)
    return user

req.log.warn({ action: "login", outcome: "failure", email: req.body.email, ip: req.ip }, "auth");
// la redaction de pino mantiene los secretos fuera aunque alguien registre el objeto completo
const logger = pino({ redact: ["req.headers.authorization", "*.password", "*.token"] });

- alert: LoginFailureSpike
  expr: sum(rate(auth_events_total{action="login",outcome="failure"}[5m])) > 5
  for: 5m
  labels: { severity: page }
  annotations:
    summary: "Fallos de login por encima de lo normal: posible credential stuffing"

def test_failed_login_is_logged_without_secrets(caplog):
    with caplog.at_level("INFO", logger="security"):
        login("bob@x.io\nlogin success", "hunter2", "203.0.113.9", "req-1")
    text = caplog.text
    assert "hunter2" not in text                      # sin secreto
    assert text.count("\n") == 1                       # el salto de línea inyectado no creó una línea
    assert '"outcome": "failure"' in text

def test_alert_fires_on_burst(alert_harness):
    for _ in range(200):
        login("bob@x.io", "bad", "203.0.113.9", "r")
    assert alert_harness.fired("LoginFailureSpike")