search

kokuwaio / keycloak-event-metrics

Provides metrics for Keycloak events
Apache License 2.0
30 stars 5 forks source link

Add configuration that allows filtering based on known `client_id` #100

Open xgp opened 1 month ago

xgp commented 1 month ago

https://github.com/kokuwaio/keycloak-event-metrics/blob/main/src/main/java/io/kokuwa/keycloak/metrics/event/MetricsEventListener.java#L36

If a Keycloak system is under attack by an adversary that is attempting to find vulnerabilities or execute script injection attacks, they may set the client_id value to arbitrary values. This can pollute the metrics, and cause an explosion of the counters. In order to mitigate this, I suggest adding a configuration that allows unknown clients to either be ignored, or grouped into an UNKNOWN client_id.

Let me know what you think, and I'll PR.

sschnabe commented 1 month ago

Ignoring them may hide the fact that the system is under attack. I would collect the unknown client_id in UNKNOWN as you proposed! Thank you!