Missing Audit Trails on User Modifications | CodeSignal Learn

Missing Audit Trails on User Modifications | CodeSignal Learn

Introduction

Welcome to the lesson on " Missing Audit Trails on User Modifications ." In this lesson, we'll explore the concept of audit trails and their critical role in web application security. Audit trails help maintain accountability and traceability, ensuring that any changes made to data are recorded and can be reviewed later. This is essential for detecting unauthorized modifications and maintaining the integrity of your application. Let's dive into the details and understand why audit trails are so important.

Understanding Audit Trails

Before we look at specific examples, let's establish a solid foundation of what audit trails are and their key components. Audit trails are records that track changes or actions performed within a system. They serve as a chronological log of events, capturing details such as who made a change, what was changed, when it was changed, and where the change originated. An effective audit trail system typically includes: User Identification : Identifying the user who made the change. Timestamp : Recording the exact time of the change. Action Details : Describing what was changed or accessed. Source Information : Capturing the IP address or device used for the change. By maintaining comprehensive audit trails, organizations can ensure accountability, detect suspicious activities, and comply with regulatory requirements. Now, let's examine a practical example to see what happens when audit trails are missing.

Example: User Profile Updates Without Audit Trails

To illustrate the importance of audit trails, let's examine a piece of TypeScript code that handles user profile updates without audit trails. User profile changes often contain sensitive information and having an audit trail is crucial for security and compliance: TypeScript import express from 'express'; import { User } from '../models/User'; const router = express.Router(); router.put('/users/:id', async (req, res) => {const id = req.params.id; const { email, role, permissions } = req.body; const user = await User.findByPk(id); if (!user) {return res.status(404).json({ error: 'User not found' });} user.email = email; user.role = role; user.permissions = permissions; await user.save(); res.json(user);}); In this code, critical user information can be modified without any record of the change. This becomes problematic when investigating security incidents or when compliance audits require historical data about user permission changes. Let's explore specific scenarios where this lack of audit trails could cause serious issues.

Sign up

Join the 1M+ learners on CodeSignal

Be a part of our community of 1M+ users who develop and demonstrate their skills on CodeSignal

Why Audit Trails Matter Here

Having seen the vulnerable code, let's examine some real-world scenarios that demonstrate why audit trails are crucial. Consider these scenarios where missing audit trails could cause issues: # An admin changes a user's role and permissions curl -X PUT http://localhost:3000/api/users/123 \ -H "Content-Type: application/json" \ -d '{ "email": "user@example.com", "role": "admin", "permissions": ["manage_users", "access_sensitive_data"] }' # Later, sensitive data is accessed, but there's no trail of who # granted these elevated permissions or when it happened Without audit trails, questions like "Who changed this user's permissions?" or "When was this email address modified?" become impossible to answer. Now that we understand the problems caused by missing audit trails, let's look at how to implement them properly.

Adding Audit Trail Support

To address these security concerns, let's start implementing a proper audit trail system. The first step in implementing audit trails is to set up our endpoint with proper state tracking. This is crucial for maintaining a clear record of what exactly changed in each update: router.put('/users/:id', async (req, res) => {const id = req.params.id; const { email, role, permissions } = req.body; const user = await User.findByPk(id); if (!user) {return res.status(404).json({ error: 'User not found' });} // Capture the original state const originalState = {email: user.email, role: user.role, permissions: user.permissions}; // Update the user user.email = email; user.role = role; user.permissions = permissions; await user.save(); This code retrieves the user record and captures the original state before making any modifications. We store the original state in a separate object so we can compare it with the changes later.

Recording the Audit Trail

With the original state captured, we can now implement the actual audit logging functionality. After capturing the original state and updating the user, we need to create an audit log entry. This code creates a detailed record of the change, including who made it, when it happened, and what exactly changed. We store both the previous and new states, along with metadata like IP address and user agent, which can be crucial for security investigations. // Create audit log entry await AuditLog.create({entityType: 'User', entityId: id, action: 'UPDATE', userId: req.user.id, timestamp: new Date(), ipAddress: req.ip, userAgent: req.headers['user-agent'], changes: {before: originalState, after: { email, role, permissions }}}); res.json(user);}); While this example shows implementation in a single endpoint, in real applications, this pattern would typically be implemented as middleware or decorators to ensure consistent audit logging across all sensitive operations. Now that we have our audit trail system in place, let's look at how to retrieve and use this information.

Querying the Audit Trail

To make our audit trail system truly useful, we need a way to access and analyze the recorded information. With audit trails in place, we can now track and investigate changes: // Example of querying the audit trail router.get('/users/:id/audit', async (req, res) => {const id = req.params.id; const auditLogs = await AuditLog.findAll({where: {entityType: 'User', entityId: id}, order: [['timestamp', 'DESC']]}); res.json(auditLogs);}); This allows us to retrieve a complete history of changes made to a user's profile, including who made the changes and when they occurred.

Shell

# An admin changes a user's role and permissions
curl -X PUT http://localhost:3000/api/users/123 \
  -H "Content-Type: application/json" \
  -d '{
    "email": "user@example.com",
    "role": "admin",
    "permissions": ["manage_users", "access_sensitive_data"]
  }'

# Later, sensitive data is accessed, but there's no trail of who
# granted these elevated permissions or when it happened

TypeScript

router.put('/users/:id', async (req, res) => {
  const id = req.params.id;
  const { email, role, permissions } = req.body;
  
  const user = await User.findByPk(id);
  if (!user) {
    return res.status(404).json({ error: 'User not found' });
  }

  // Capture the original state
  const originalState = {
    email: user.email,
    role: user.role,
    permissions: user.permissions
  };

  // Update the user
  user.email = email;
  user.role = role;
  user.permissions = permissions;
  await user.save();

TypeScript

  // Create audit log entry
  await AuditLog.create({
    entityType: 'User',
    entityId: id,
    action: 'UPDATE',
    userId: req.user.id,
    timestamp: new Date(),
    ipAddress: req.ip,
    userAgent: req.headers['user-agent'],
    changes: {
      before: originalState,
      after: { email, role, permissions }
    }
  });
  
  res.json(user);
});

TypeScript

// Example of querying the audit trail
router.get('/users/:id/audit', async (req, res) => {
  const id = req.params.id;
  
  const auditLogs = await AuditLog.findAll({
    where: {
      entityType: 'User',
      entityId: id
    },
    order: [['timestamp', 'DESC']]
  });
  
  res.json(auditLogs);
});