corazawaf / coraza

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library
https://www.coraza.io
Apache License 2.0
2.23k stars 221 forks source link

Logging testing #849

Open jcchavezs opened 1 year ago

jcchavezs commented 1 year ago

Description

Over the last months we have been receiving issues from users that involve log output in different parts of the library and connectors. For example:

While usually logs are not part of the public API because they are not something people are supposed to consume in a consistent or programatic way, it looks like in a WAF (by popular demand) they are crucial when it comes to operating a system that consumes this library in any way.

Hence, because software is built on top of use cases, for coraza specifically, we should be assuring that logs are also something to consider when it comes to production readiness.

Expected result

The outcome of this epic should be:

  1. identifying the critial outcomes from logs
  2. add tests that assert correctness around them
  3. Close all the aforementioned issues
fzipi commented 1 year ago

This epic should reflect that there are three different kinds of logs: