Sacha Al Himdani 9eed0d71c8 Log identity_id on every authenticated request ...

Add a single info log line in each authn middleware once an identity is
resolved, so every authenticated request emits a record that ties the
request back to its user and credential:

- Cookie session middleware logs "session authenticated" with
  identity_id and session_id.
- API key middleware logs "api key authenticated" with identity_id and
  api_key_id.
- OAuth2 access token middleware logs "access token authenticated"
  with identity_id and access_token_id.

The credential IDs are row identifiers (GIDs), not the secret token
values, so they're safe to log and let operators correlate a request
back to the specific credential used. The log lines use the
request-scoped logger from httpserver.LoggerFromContext so they
inherit http_request_id and any other middleware-attached attributes.

Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>

2026-05-13 15:49:52 +02:00

3.0 KiB

Raw Blame History

View Raw