Skip to content

Audit log URLs are incomplete #141

@zedkipp

Description

@zedkipp

I'm seeing the audit logs recorded by boundary seem to only have the path portion of the URL rather than a fully qualified URL. The application logs also seem to suffer from the same problem.

Application log example (from /tmp/boundary_logs/... on dogfood):
time=2026-01-06T15:51:12.123Z level=WARN msg=DENY method=POST url=/api/api_post.php host=pastebin.com
I think the url field should be url=https://pastebin.com/api/api_post.php

Audit log example from coderd logs for allowed request:
2026-01-06 15:50:31.267 [info] coderd.agentrpc: boundary_request trace=c4d6a7aaf78a5c232a9fe76ee93f2c6a span=2def2b54ab24ce2f owner=zachkipp workspace_name=upload-source-pastebin-bb0d agent_name=dev decision=allow workspace_id=b21d26f6-b45e-4d3d-b1b9-9ac9a7403626 http_method=GET http_url=/lookup/github.com/modelcontextprotocol/go-sdk@v0.8.0 event_time=2026-01-06T15:50:31.252989316Z matched_rule=domain=[sum.golang.org](http://sum.golang.org/) request_id=dfaf838f-37c7-4941-b5db-442ca000b797

Audit log example from coderd logs for denied request:
2026-01-06 15:50:38.865 [info] coderd.agentrpc: boundary_request trace=c4d6a7aaf78a5c232a9fe76ee93f2c6a span=2def2b54ab24ce2f owner=zachkipp workspace_name=upload-source-pastebin-bb0d agent_name=dev decision=deny workspace_id=b21d26f6-b45e-4d3d-b1b9-9ac9a7403626 http_method=POST http_url=/api/v2/logs event_time=2026-01-06T15:50:37.259073861Z request_id=dfaf838f-37c7-4941-b5db-442ca000b797

Relates to coder/coder#21280

Metadata

Metadata

Assignees

Labels

No labels
No labels

Type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions