Insufficient Logging

// config/CustomAuthProvider.java
public class CustomAuthProvider implements AuthenticationProvider {
    @Override
    public Authentication authenticate(Authentication auth) throws AuthenticationException {
        // ... load user, check password ...
        if (password_is_incorrect) {
            // DANGEROUS: Throws exception, but failure is not explicitly logged
            // with username and IP. Spring Security might log a generic
            // "Bad credentials" message at DEBUG level, which is often disabled in prod.
            throw new BadCredentialsException("Invalid credentials");
        }
        // ... success logic ...
    }
    // ...
}

// controller/AdminController.java
@GetMapping("/admin/panel")
public String getAdminPanel(Principal principal) {
    User user = userService.findByUsername(principal.getName());
    if (!user.isAdmin()) {
        // DANGEROUS: Returns 403, but no log entry is created
        // to record that this user tried to access an admin function.
        throw new AccessDeniedException("Forbidden");
    }
    // ... return admin panel ...
}

// config/AuthenticationEventListener.java (Secure)
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.context.ApplicationListener;
import org.springframework.security.authentication.event.AuthenticationFailureBadCredentialsEvent;
import org.springframework.security.authentication.event.AuthenticationSuccessEvent;
import org.springframework.stereotype.Component;
// Assume WebAuthenticationDetails is available for IP

@Component
public class AuthenticationEventListener implements
        ApplicationListener<AuthenticationFailureBadCredentialsEvent> {
    private static final Logger log = LoggerFactory.getLogger(AuthenticationEventListener.class);
    @Override
    public void onApplicationEvent(AuthenticationFailureBadCredentialsEvent event) {
        String username = event.getAuthentication().getName();
        // Get IP (requires request context or details object)
        // String ip = ((WebAuthenticationDetails) event.getAuthentication().getDetails()).getRemoteAddress();
        String ip = "IP_NOT_CAPTURED_IN_EXAMPLE"; // Placeholder
        // SECURE: Log failed login at WARN level
        log.warn("Login Failed: Username '{}', IP {}", username, ip);
    }
}
// Implement a similar listener for AuthenticationSuccessEvent at INFO level.

// controller/AdminController.java (Secure)
@GetMapping("/admin/panel")
public String getAdminPanel(Principal principal) {
    User user = userService.findByUsername(principal.getName());
    if (!user.isAdmin()) {
        // SECURE: Log the access control failure
        // Get IP from HttpServletRequest (needs to be injected or available)
        String ip = "IP_NOT_CAPTURED_IN_EXAMPLE"; // Placeholder
        log.warn("Access Denied: User '{}' (not admin) " +
                 "tried to access /admin/panel. IP {}", user.getUsername(), ip);
        throw new AccessDeniedException("Forbidden");
    }
    // ... return admin panel ...
}

// Controllers/AccountController.cs
public async Task<IActionResult> Login(LoginViewModel model)
{
    if (ModelState.IsValid)
    {
        var result = await _signInManager.PasswordSignInAsync(model.Email, model.Password, model.RememberMe, lockoutOnFailure: true);
        if (result.Succeeded)
        {
            // Identity logs this success at INFO level (good)
            _logger.LogInformation("User logged in.");
            return RedirectToLocal(model.ReturnUrl);
        }
        if (result.IsLockedOut)
        {
            // DANGEROUS: Lockout is a critical security event but might
            // only be logged by Identity at DEBUG/INFO, or not at all.
            // Should be logged at WARN level.
            _logger.LogWarning("User account locked out: {Email}", model.Email); // Good, but might be missing
        }
        else
        {
            // DANGEROUS: Failed attempt not explicitly logged at WARN level.
            // Identity's default log might be DEBUG/INFO, which is often off in prod.
            ModelState.AddModelError(string.Empty, "Invalid login attempt.");
        }
    }
    return View(model);
}

// Controllers/AdminController.cs
[Authorize(Roles = "Admin")]
public class AdminController : Controller
{
    public IActionResult Index() // Non-admin user tries to access /Admin/Index
    {
        // The [Authorize] attribute blocks them (good),
        // but DANGEROUS: No log event is generated by default
        // to show that 'user_abc' tried to access this.
        return View();
    }
}

// Controllers/AccountController.cs (Secure Logging)
public async Task<IActionResult> Login(LoginViewModel model)
{
    var ip = HttpContext.Connection.RemoteIpAddress?.ToString(); // Get IP
    if (ModelState.IsValid)
    {
        var result = await _signInManager.PasswordSignInAsync(model.Email, model.Password, model.RememberMe, lockoutOnFailure: true);
        if (result.Succeeded)
        {
            _logger.LogInformation("Login Success: User {Email}, IP {IP}", model.Email, ip);
            return RedirectToLocal(model.ReturnUrl);
        }
        if (result.IsLockedOut)
        {
            // SECURE: Log lockouts as high severity
            _logger.LogWarning("Account Lockout: User {Email}, IP {IP}", model.Email, ip);
        }
        else if (result.RequiresTwoFactor)
        {
            _logger.LogInformation("Login Requires 2FA: User {Email}, IP {IP}", model.Email, ip);
            // ... redirect to 2FA page ...
        }
        else
        {
            // SECURE: Log all other failed attempts
            _logger.LogWarning("Login Failure: User {Email}, IP {IP}", model.Email, ip);
        }
        ModelState.AddModelError(string.Empty, "Invalid login attempt.");
    }
    return View(model);
}

// Custom Authorization Failure Logging (Conceptual - in Startup.cs)
// services.AddSingleton<IAuthorizationMiddlewareResultHandler, MyLoggingAuthHandler>();
// public class MyLoggingAuthHandler : IAuthorizationMiddlewareResultHandler
// {
//     private readonly ILogger _logger;
//     private readonly AuthorizationMiddlewareResultHandler _defaultHandler = new();
//
//     public MyLoggingAuthHandler(ILogger<MyLoggingAuthHandler> logger) { _logger = logger; }
//
//     public async Task HandleAsync(RequestDelegate next, HttpContext context, AuthorizationPolicy policy, PolicyAuthorizationResult authorizeResult)
//     {
//         if (!authorizeResult.Succeeded && authorizeResult.AuthorizationFailure != null)
//         {
//             // SECURE: Log authorization failures
//             var user = context.User?.Identity?.Name ?? "Anonymous";
//             var ip = context.Connection.RemoteIpAddress?.ToString();
//             _logger.LogWarning("Authorization Failure: User {User} at IP {IP} " +
//                              "failed policy {PolicyName} for path {Path}",
//                              user, ip, policy.DisplayName, context.Request.Path);
//         }
//         // Call default handler to apply the actual result (e.g., return 403)
//         await _defaultHandler.HandleAsync(next, context, policy, authorizeResult);
//     }
// }

// app/Http/Controllers/Auth/LoginController.php
// Uses AuthenticatesUsers trait. Fires Login and Failed events.
// DANGEROUS: No listener configured in EventServiceProvider
// to catch these events and log them with IP/context.

// app/Http/Controllers/PostController.php
public function update(Request $request, Post $post)
{
    // DANGEROUS: Gate denies access, but the attempt is not logged.
    // Attacker can enumerate post IDs trying to find one they can edit.
    if (Gate::denies('update-post', $post)) {
        abort(403);
    }
    // ... update logic ...
}

// app/Providers/EventServiceProvider.php (Register Listeners)
use App\Listeners\LogSuccessfulLogin;
use App\Listeners\LogFailedLogin;
use Illuminate\Auth\Events\Login;
use Illuminate\Auth\Events\Failed;

protected $listen = [
    // SECURE: Register listeners for auth events
    Login::class => [
        LogSuccessfulLogin::class,
    ],
    Failed::class => [
        LogFailedLogin::class,
    ],
];

// app/Listeners/LogFailedLogin.php (Example Listener)
namespace App\Listeners;
use Illuminate\Auth\Events\Failed;
use Illuminate\Support\Facades\Log;

class LogFailedLogin
{
    public function handle(Failed $event)
    {
        $ip = request()->ip();
        $username = $event->credentials['email'] ?? 'unknown'; // Get attempted email
        // SECURE: Log failure at 'warning' level
        Log::warning("Login Failed: Username '{$username}', IP {$ip}");
    }
}
// (Create similar LogSuccessfulLogin using $event->user and Log::info)

// app/Http/Controllers/PostController.php (Secure Gate Logging)
public function update(Request $request, Post $post)
{
    if (Gate::denies('update-post', $post)) {
        // SECURE: Log the access control failure
        Log::warning("Access Denied: User '{$request->user()->id}' " .
                     "tried to update post '{$post->id}'. IP {$request->ip()}");
        abort(403);
    }
    // ... update logic ...
}

// config/passport.js
passport.use(new LocalStrategy(
  (username, password, done) => {
    User.findOne({ username: username }, (err, user) => {
      if (err) { return done(err); }
      if (!user) {
        // DANGEROUS: Failure not logged
        return done(null, false, { message: 'Incorrect username.' });
      }
      if (!user.comparePassword(password)) { // Assume comparePassword exists
        // DANGEROUS: Failure not logged
        return done(null, false, { message: 'Incorrect password.' });
      }
      return done(null, user); // Success
    });
  }
));

// middleware/authz.js
function ensureAdmin(req, res, next) {
    if (req.isAuthenticated() && req.user.role === 'admin') {
        return next();
    }
    // DANGEROUS: Access failure not logged.
    res.status(403).send('Forbidden');
}
// app.use('/admin', ensureAdmin, adminRoutes);

// config/passport.js (Secure Logging)
// Assume logger (e.g., Winston) is configured and available
const logger = require('../utils/logger');

passport.use(new LocalStrategy(
  (username, password, done) => {
    // Get IP from request (requires passing req to strategy: new LocalStrategy({passReqToCallback: true}, ...))
    // (username, password, done) -> (req, username, password, done)
    // const ip = req.ip; // Assume req is available

    User.findOne({ username: username }, (err, user) => {
      if (err) {
        logger.error(`Error finding user '${username}': ${err.message}`);
        return done(err);
      }
      if (!user) {
        // SECURE: Log failure
        logger.warn(`Login Failed (User Not Found): Username '${username}', IP ${req.ip}`);
        return done(null, false, { message: 'Incorrect username.' });
      }
      user.comparePassword(password, (compareErr, isMatch) => { // Assume async compare
         if (compareErr) return done(compareErr);
         if (isMatch) {
             logger.info(`Login Success: Username '${username}', IP ${req.ip}`);
             return done(null, user);
         } else {
             // SECURE: Log failure
             logger.warn(`Login Failed (Wrong Password): Username '${username}', IP ${req.ip}`);
             return done(null, false, { message: 'Incorrect password.' });
         }
      });
    });
  }
));

// middleware/authz.js (Secure Logging)
// const logger = require('../utils/logger');
function ensureAdminSecure(req, res, next) {
    if (req.isAuthenticated() && req.user.role === 'admin') {
        return next();
    }
    // SECURE: Log access control failure
    logger.warn(`Access Denied: User '${req.user.id}' (not admin) ` +
                `tried to access ${req.originalUrl}. IP ${req.ip}`);
    res.status(403).send('Forbidden');
}

# config/initializers/devise.rb
# Default logging might not be at a high enough level (WARN)
# to trigger alerts in production log monitoring.

# app/policies/post_policy.rb
class PostPolicy < ApplicationPolicy
  def update?
    # DANGEROUS: Returns false, but the attempt is not logged.
    # Attacker can try to update many different post IDs.
    user.admin? || record.user == user
  end
end

# app/controllers/posts_controller.rb
def update
  @post = Post.find(params[:id])
  authorize @post # Throws Pundit::NotAuthorizedError if policy fails
  # ... update logic ...
  # The default ApplicationController.rescue_from Pundit::NotAuthorizedError
  # just redirects or shows 403, it doesn't log the attempt.
end

# config/initializers/devise_failure_logging.rb (Secure)
# Subscribe to Warden's failure event (used by Devise)
Warden::Manager.after_authentication do |user, auth, opts|
  # Log successful logins (optional, but good)
  if opts[:event] == :authentication
    Rails.logger.info "Login Success: User #{user.email}, IP #{auth.request.remote_ip}"
  end
end
Warden::Manager.before_failure do |env, opts|
  # Log failed logins
  if opts[:action] == 'unauthenticated' && opts[:scope] == :user && opts[:message] != :unauthenticated
     email = env['action_dispatch.request.request_parameters']&.dig(:user, :email)
     ip = env['action_dispatch.remote_ip']
     # SECURE: Log failed attempt at WARN level
     Rails.logger.warn "Login Failed: Email '#{email}', IP #{ip}, Reason: #{opts[:message]}"
  end
end

# app/controllers/application_controller.rb (Secure Pundit Logging)
class ApplicationController < ActionController::Base
  include Pundit::Authorization # Assuming Pundit
  # SECURE: Rescue from authorization failures
  rescue_from Pundit::NotAuthorizedError, with: :user_not_authorized

  private
  def user_not_authorized(exception)
    # SECURE: Log the authorization failure
    policy_name = exception.policy.class.to_s.underscore
    query_name = exception.query.to_s
    user_info = current_user ? "User '#{current_user.id}'" : "Anonymous user"
    Rails.logger.warn "Authorization Failure: #{user_info} at IP #{request.remote_ip} " +
                      "forbidden by #{policy_name}##{query_name}"
    
    flash[:alert] = "You are not authorized to perform this action."
    redirect_to(request.referrer || root_path)
  end
end