Chapter 2 · Practice 4 of 4
Log every authentication event and alert on patterns
Why it matters
You cannot respond to an attack you cannot see. OWASP recommends logging and reviewing all authentication failures, password failures and account lockouts, and monitoring authentication in real time.
Log these events with a timestamp, account ID, source IP, user agent and outcome:
- successful and failed sign-ins
- lockouts and unlocks
- password changes and resets
- MFA enrolment, removal and failures
- passkey added or removed
- sessions revoked
Alerts worth having:
- a spike in failed logins across many accounts (credential stuffing)
- many failures on one account from many IPs
- a successful login right after a burst of failures
- MFA being disabled shortly after a password reset
Never log the password itself, OTP codes, reset tokens or session IDs. Log an identifier or a short hash if you need to correlate.