From 74b514c8775eca142b4d6015f3767156084c02c7 Mon Sep 17 00:00:00 2001 From: Jiongxuan Zhang Date: Thu, 10 Oct 2024 23:26:01 +0800 Subject: [PATCH] feat(authentication): enhance login failure logging and reduce log volume - Added logging for invalid username attempts to provide more detailed failure reasons. - Removed "login attempt" log entries to reduce log volume and focus on final verification results. - Retained logging for invalid password and successful user authorization for clarity. --- lib/handler.go | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/lib/handler.go b/lib/handler.go index dbc4a90..63e5558 100644 --- a/lib/handler.go +++ b/lib/handler.go @@ -89,7 +89,8 @@ func (h *Handler) ServeHTTP(w http.ResponseWriter, r *http.Request) { // Gets the correct user for this request. username, password, ok := r.BasicAuth() - zap.L().Info("login attempt", zap.String("username", username), zap.String("remote_address", remoteAddr)) + // Removed the login attempt log to reduce log volume and focus on final verification results + // zap.L().Info("login attempt", zap.String("username", username), zap.String("remote_address", remoteAddr)) if !ok { http.Error(w, "Not authorized", http.StatusUnauthorized) return @@ -97,17 +98,21 @@ func (h *Handler) ServeHTTP(w http.ResponseWriter, r *http.Request) { user, ok = h.users[username] if !ok { + // Log invalid username + zap.L().Info("invalid username", zap.String("username", username), zap.String("remote_address", remoteAddr)) http.Error(w, "Not authorized", http.StatusUnauthorized) return } if !h.noPassword && !user.checkPassword(password) { + // Log invalid password zap.L().Info("invalid password", zap.String("username", username), zap.String("remote_address", remoteAddr)) http.Error(w, "Not authorized", http.StatusUnauthorized) return } - zap.L().Info("user authorized", zap.String("username", username)) + // Log successful authorization + zap.L().Info("user authorized", zap.String("username", username), zap.String("remote_address", remoteAddr)) } // Cleanup destination header if it's present by stripping out the prefix