Graylog2 / Graylog2/graylog2-server

Update audit annotations and checks to support intentions more clearly

Open
#18,540 0 comments 0 reactions 0 assignees View on GitHub
infrastructure
Dominant language
Java
Stars
8.1k
Forks
1.1k
Avg merge
1d 20h
Merged PRs (30d)
217

Description

## Expected Behavior
During development, it is often necessary to suppress audit event checking due to the added complexity of writing audit event formatters, etc.
The `@NoAuditEvent` annotation is often used, but it is very easy to miss adding them later.
The resource method annotation should make the intention of skipping audit events clearer than the string we currently use.

## Current Behavior
We currently have https://github.com/Graylog2/graylog2-server/blob/master/graylog2-server/src/main/java/org/graylog2/audit/jersey/NoAuditEvent.java to indicate that no audit event is necessary for a non-GET HTTP method resource.

## Possible Solution
Migrate the annotation to require picking an enum value for the reasons of omitting the automatic audit event generation.
Likely causes are:
* The resource does not cause an audit-worthy change at all, e.g. invalidates a cache, just technical reason for not using a GET etc
* The resource manually creates audit events in its implementation
* We are intentionally skipping defining audit events during development (this is rare and code using this should never make it to stable builds, it should probably fail builds).

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.