-
Notifications
You must be signed in to change notification settings - Fork 5.5k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
feat(security): log user when access is blocked #16558
feat(security): log user when access is blocked #16558
Conversation
Signed-off-by: Michael Crenshaw <350466+crenshaw-dev@users.noreply.github.com>
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## master #16558 +/- ##
==========================================
+ Coverage 49.48% 49.50% +0.02%
==========================================
Files 270 270
Lines 47489 47494 +5
==========================================
+ Hits 23502 23514 +12
+ Misses 21675 21670 -5
+ Partials 2312 2310 -2 ☔ View full report in Codecov by Sentry. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Shouldn't this be a configurable option instead of logging user details by default?
@reversearrow user info is already logged in the grpc claims on the request log. Both should be optional, but this PR doesn't introduce logged PII that wasn't otherwise there. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM
Signed-off-by: Michael Crenshaw <350466+crenshaw-dev@users.noreply.github.com>
Signed-off-by: Michael Crenshaw <350466+crenshaw-dev@users.noreply.github.com> Signed-off-by: penglongli <pelenli@tencent.com>
Signed-off-by: Michael Crenshaw <350466+crenshaw-dev@users.noreply.github.com> Signed-off-by: Kevin Lyda <kevin@lyda.ie>
Signed-off-by: Michael Crenshaw <350466+crenshaw-dev@users.noreply.github.com>
We currently log access errors, but we don't log who attempted the disallowed access. This just adds the username/email to the logs.