How To Log When Invalid Bearer Token Is Sent To Backend

user_12889696 0
Viewed 1138

I have a Jhipster built backend and am looking to log when an invalid authentication Bearer token is sent with a request.

Currently using Postman I can send a valid token to get information I need and that is logged like so:

2020-10-14 10:11:37.591 DEBUG 4132 --- [  XNIO-1 task-1] s.n.www.protocol.http.HttpURLConnection  : sun.net.www.MessageHeader@77674d5d5 pairs: {GET /auth/realms/p
latform-development/protocol/openid-connect/certs HTTP/1.1: null}{Accept: application/json, application/jwk-set+json}{User-Agent: Java/11.0.7}{Host: sso.eva-int.c
om}{Connection: keep-alive}
2020-10-14 10:11:37.630 DEBUG 4132 --- [  XNIO-1 task-1] s.n.www.protocol.http.HttpURLConnection  : sun.net.www.MessageHeader@2527b0a66 pairs: {null: HTTP/1.1 200
 OK}{Connection: keep-alive}{Cache-Control: no-cache}{Content-Type: application/json}{Content-Length: 1703}{Date: Wed, 14 Oct 2020 17:11:36 GMT}
2020-10-14 10:11:37.649 DEBUG 4132 --- [  XNIO-1 task-1] jdk.event.security                       : X509Certificate: Alg:SHA256withRSA, Serial:17251f0f612, Subjec
t:CN=platform-development, Issuer:CN=platform-development, Key type:RSA, Length:2048, Cert Id:1603036153, Valid from:5/26/20, 10:02 AM, Valid until:5/26/30, 10:04
 AM

When I send an invalid token I get back a response with a status of 401 and headers saying 'invalid_token' which is perfectly fine, but nothing is logged in the application.

It seems like the code that handles this comes from Spring Security dependency. Is there any way to have it log out more information?

jwt-auth jhipster oauth-2.0 spring-security java
1 Answers

Spring Security has its own logging, you just need to enable it.

Put the following in your application.properties:

logging.level.org.springframework.security=DEBUG

This is the same for most other Spring modules as well.

OR

Try setting the property in your logging configuration, e.g. logback.

Here is the application.yml version:

logging:
  level:
    org:
      springframework:
        security: DEBUG
user_48505880
Related