search

DuendeSoftware / IdentityServer

The most flexible and standards-compliant OpenID Connect and OAuth 2.x framework for ASP.NET Core
https://duendesoftware.com/products/identityserver
Other
1.44k stars 322 forks source link

IdentityServer Error LogLevel #1547

Open ruudhe opened 4 months ago

ruudhe commented 4 months ago

Which version of Duende IdentityServer are you using? IdentityServer 7.0.3 BFF 2.2.0

Which version of .NET are you using? net8.0

Describe the bug On a high volume public facing deployment our logs are spammed with IdentityServer Errors which are generated by security scans or wrong user input. The validators used in identityserver are logging all invalid requests as an Error, for example:

AuthorizeRequestValidator https://github.com/DuendeSoftware/IdentityServer/blob/352706997d1ce8a4564a146f1c4a37cd459b724f/src/IdentityServer/Validation/Default/AuthorizeRequestValidator.cs#L160 https://github.com/DuendeSoftware/IdentityServer/blob/352706997d1ce8a4564a146f1c4a37cd459b724f/src/IdentityServer/Validation/Default/AuthorizeRequestValidator.cs#L201 https://github.com/DuendeSoftware/IdentityServer/blob/352706997d1ce8a4564a146f1c4a37cd459b724f/src/IdentityServer/Validation/Default/AuthorizeRequestValidator.cs#L226

ProtectedDataMessageStore https://github.com/DuendeSoftware/IdentityServer/blob/352706997d1ce8a4564a146f1c4a37cd459b724f/src/IdentityServer/Stores/Default/ProtectedDataMessageStore.cs#L62

Expected behavior We would like to request a change that the logging level for these kind of log statements can be configured from Error to Warning so error reporting would not give so much errors due to improper usage / url scanning.

AndersAbel commented 4 months ago

Thanks for your feedback, I think this makes sense. I'm transferring the issue to the main IdentityServer repo for triage/planning.