Bruteforce security for 2FA

[mangoman16]

Hello everyone, while trying to set up fail2ban, I noticed that it is not possible to ban wrong 2FA attempts, since there is no IP in the Accesslog and I cannot write a regex for it:

This is how my config looks like:

      LOG_FILE: "/data/vaultwarden.log"
      EXTENDED_LOGGING: "true"
      LOG_LEVEL: "trace"

This is a cut of the access log of me trying to log in with false 2FA (email in this case):
`[2025-01-27 10:49:03.224][tracing::span][TRACE] parse_headers;

[2025-01-27 10:49:03.224][tracing::span::active][TRACE] -> parse_headers;

[2025-01-27 10:49:03.224][tracing::span::active][TRACE] <- parse_headers;

[2025-01-27 10:49:03.224][tracing::span][TRACE] -- parse_headers;

[2025-01-27 10:49:03.225][request][INFO] POST /identity/connect/token

[2025-01-27 10:49:03.225][rocket::form::parser::_][TRACE] url-encoded field: ("scope", "api%20offline_access")

[2025-01-27 10:49:03.225][rocket::form::parser::_][TRACE] url-encoded field: ("client_id", "web")

[2025-01-27 10:49:03.225][rocket::form::parser::_][TRACE] url-encoded field: ("deviceType", "12")

[2025-01-27 10:49:03.225][rocket::form::parser::_][TRACE] url-encoded field: ("deviceIdentifier", "b215664c-392c-4dd5-8644-c7c50aeeeda3")

[2025-01-27 10:49:03.225][rocket::form::parser::_][TRACE] url-encoded field: ("deviceName", "edge")

[2025-01-27 10:49:03.225][rocket::form::parser::_][TRACE] url-encoded field: ("twoFactorToken", "123456")

[2025-01-27 10:49:03.226][rocket::form::parser::_][TRACE] url-encoded field: ("twoFactorProvider", "1")

[2025-01-27 10:49:03.226][rocket::form::parser::_][TRACE] url-encoded field: ("twoFactorRemember", "0")

[2025-01-27 10:49:03.226][rocket::form::parser::_][TRACE] url-encoded field: ("grant_type", "password")

[2025-01-27 10:49:03.226][rocket::form::parser::_][TRACE] url-encoded field: ("username", "admin%mydomain.li")

[2025-01-27 10:49:03.226][rocket::form::parser::_][TRACE] url-encoded field: ("password", "XXhashedXX")

[2025-01-27 10:49:03.587][vaultwarden::api::core::two_factor::email][ERROR] Token is invalid

[2025-01-27 10:49:03.587][response][INFO] (login) POST /identity/connect/token => 400 Bad Request

[2025-01-27 10:49:03.588][tracing::span][TRACE] encode_headers;

[2025-01-27 10:49:03.588][tracing::span::active][TRACE] -> encode_headers;

[2025-01-27 10:49:03.588][tracing::span::active][TRACE] <- encode_headers;

[2025-01-27 10:49:03.588][tracing::span][TRACE] -- encode_headers;`
Any option to include the client IP in the logs? Am I worrying too much perhaps?