spring-projects / spring-projects/spring-security
Improve Observability
Open
@jzheaux is already working on this.
Since Jul 5, 2022.
in: core
theme: observability
type: enhancement
- Dominant language
- Java
- Stars
- 9.6k
- Forks
- 6.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 52
Description
Making Spring Security's actions observable at runtime will help make applications more secure. Following recommendations from OWASP, we should:
- Add authorization events
- Add OAuth2 client authorization events
- Add defense violation events (CSP violation, CSRF violation, firewall rejection, etc.)
- Add user/password lifecycle events
- Consider introducing secure header
report-uriendpoints
It would be helpful to have a marker class that security events can be identified by:
- Add SecurityEvent
When these events are fired, Spring Security should:
- Pipe authentication events to Micrometer
- Pipe authorization events to Micrometer
- Pipe defense violation events to Micrometer
- Pipe session management events to Micrometer
- Pipe custom security events to Micrometer
It can also help applications evaluate performance and usage. To that end we should:
- #11989
- Instrument
OAuth2AuthorizedClientProvider - #11990
- #11991
- #11992
- #11993
- #11994
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.