search

nathanl / authority

*CURRENTLY UNMAINTAINED*. Authority helps you authorize actions in your Rails app. It's ORM-neutral and has very little fancy syntax; just group your models under one or more Authorizer classes and write plain Ruby methods on them.
MIT License
1.21k stars 67 forks source link

Log all authorization attempts? #118

Closed nathanl closed 7 years ago

nathanl commented 7 years ago

I got a question via Twitter and thought it would be best to make it a discussion here:

any recommendations for logging all authorization attempts via authority?

nathanl commented 7 years ago

Logging all authorization attempts would currently require modifying Authority, either as a monkey patch or a PR.

Here's how logging is currently done.

First, Authority.enforce raises an exception if an attempted action is unauthorized.

Then this code rescues the exception and calls your configured security_violation_handler.

By default, that's the :authority_forbidden method, which logs the violation and renders a 403.

So to log all attempts at authorization, successful or not, would require modifying Authority.enforce to have it log any attempted access. Eg, it could do Authority.logger.info("#{user} is attempting to #{action} #{resource} with options #{options}". It could still leave it to the exception handler to make a second warn log entry if the action is unauthorized.

That's not a hard change, but I don't know if any users would object to having those extra log messages. We could configure whether to log in that case, but more options == more complexity.

forced-request commented 7 years ago

Thanks @nathanl. I think it's good to have the option. This allows developers to better audit user actions. I would probably have this disabled by default, and be enabled via the rollbar initializer.

nathanl commented 7 years ago

@forced-request I can see why you'd want to be able to log everything. Interested in making a PR?

forced-request commented 7 years ago

I should be able to make that happen. I'll get back to you soon.

nathanl commented 7 years ago

Fixed in https://github.com/nathanl/authority/pull/119