Security Event Logging

Security Event Logging

Security logs should report what the request actually did, avoid duplicate events across filter paths, and exclude credentials and request content. Unit tests for a listener alone do not prove that real denials reach it.

Match events to HTTP behavior

Exercise anonymous, authenticated-but-forbidden, and CSRF-denied requests through the real security chain. Assert the event classification and status against the resulting HTTP response. Test exactly-once behavior because some filters handle refusals directly instead of publishing the same event as the authorization path.

Test missing request and authentication context. Verify the implementation handles absent suppliers and values safely; a null-authentication test does not prove that a null supplier is safe.

Minimize logged data

Log a small, structured allowlist, such as route template, method, correlation identifier, issuer, subject, and failure category when available. Do not serialize the request, principal, token, cookie, authorization header, query, or body. Assert that synthetic secrets and request markers do not appear in captured output.

Also validate identity and correlation fields against log-injection risks. Application tests do not establish downstream sink access, retention, transport, parsing, or alerting; assign those checks to the platform owner.

Waste Plus evidence

Both listeners classify anonymous denials as 401 and authenticated denials as 403. CSRF refusals use a separate handler because the CSRF filter short-circuits its path. Legacy integration coverage checks HTTP denial status against event status and verifies that tested denials do not call business services. The legacy listener now resolves the authentication supplier once and passes the resolved value through logging.

SecurityEventLoggingListenerTest.authorizationDenialReadsAuthenticationSupplierOnce checks this behavior.

The backend listener still passes the authentication supplier into logEvent, where safeIdentity resolves it again after the initial classification read. Keep this module-specific difference visible when reviewing supplier-backed event APIs; the legacy regression test does not establish the backend behavior.

Evidence sources

• backend/src/main/java/ca/bc/gov/nrs/hrs/security/SecurityEventLoggingListener.java
• backend/src/main/java/ca/bc/gov/nrs/hrs/security/CsrfAccessDeniedHandler.java
• backend/src/test/java/ca/bc/gov/nrs/hrs/security/SecurityEventLoggingListenerTest.java
• backend/src/test/java/ca/bc/gov/nrs/hrs/security/CsrfAccessDeniedHandlerTest.java
• legacy/src/test/java/ca/bc/gov/nrs/hrs/controller/ApiAuthorizationBoundaryIntegrationTest.java
• final/SECURITY-EVENT-LOGGING-REVIEW.md