Improve Observability - Githubissues

spring-projects / spring-security

Spring Security

http://spring.io/projects/spring-security

Apache License 2.0

8.81k stars 5.9k forks source link

Improve Observability #10964

Open jzheaux opened 2 years ago

jzheaux commented 2 years ago

Making Spring Security's actions observable at runtime will help make applications more secure. Following recommendations from OWASP, we should:

[x] Add authorization events
[ ] Add OAuth2 client authorization events
[ ] Add defense violation events (CSP violation, CSRF violation, firewall rejection, etc.)
[ ] Add user/password lifecycle events
[ ] Consider introducing secure header report-uri endpoints

It would be helpful to have a marker class that security events can be identified by:

[ ] Add SecurityEvent

When these events are fired, Spring Security should:

[ ] Pipe authentication events to Micrometer
[ ] Pipe authorization events to Micrometer
[ ] Pipe defense violation events to Micrometer
[ ] Pipe session management events to Micrometer
[ ] Pipe custom security events to Micrometer

It can also help applications evaluate performance and usage. To that end we should:

[x] #11989
[ ] Instrument OAuth2AuthorizedClientProvider
[x] #11990
[x] #11991
[x] #11992
[ ] #11993
[x] #11994

jzheaux commented 2 years ago

Before proceeding on piping events, it's important to understand the following two scenarios:

How does this complement (or not) Spring Actuator
What does event collection look like when events are published asynchronously