Security Logging and Monitoring in Express Applications

Introduction

Welcome to the final lesson in our Server-Side Request Forgery (SSRF) Prevention in Express course! In this lesson, we'll explore security logging and monitoring in depth. Effective logging and monitoring are crucial components of a comprehensive security strategy, as they help you detect, investigate, and respond to security incidents promptly. Let's dive in and discover how to implement these practices in your Express applications! 📊

The Role of Security Logging

Security logging is the practice of recording events related to security concerns within your application. Properly implemented logs serve multiple purposes: Detecting Security Incidents: Logs can reveal suspicious activities that may indicate ongoing attacks. Investigating Breaches: After a security incident, logs provide valuable data for forensic analysis. Compliance Requirements: Many regulatory frameworks require specific logging practices. System Auditing: Logs help track user activities and system changes over time. Let's implement a comprehensive logging system using the popular Winston library: TypeScriptimport express from 'express'; import winston from 'winston'; import expressWinston from 'express-winston'; import path from 'path'; const app = express(); app.use(express.json()); // Configure logging format and transports const logger = winston.createLogger({ level: process.env.LOG_LEVEL || 'info', format: winston.format.combine( winston.format.timestamp(), winston.format.json() ), defaultMeta: { service: 'web-service' }, transports: [ // Console transport for development new winston.transports.Console({ format: winston.format.combine( winston.format.colorize(), winston.format.simple() ) }), // File transport for persistent logs new winston.transports.File({ filename: path.join(__dirname, 'logs/error.log'), level: 'error' }), new winston.transports.File({ filename: path.join(__dirname, 'logs/combined.log') }) ] }); // Log all HTTP requests app.use(expressWinston.logger({ winstonInstance: logger, meta: true, msg: 'HTTP {{req.method}} {{req.url}}', expressFormat: true, colorize: false })); // Add custom security logging middleware app.use((req, res, next) => { // Log potentially suspicious activities if (req.body?.url || req.query?.url) { logger.warn('URL parameter detected', { ip: req.ip, url: req.body.url || req.query.url, method: req.method, path: req.path, userAgent: req.headers['user-agent'] }); } next(); }); // Example route app.get('/', (req, res) => { res.send('Hello, world!'); }); // Error logging middleware app.use(expressWinston.errorLogger({ winstonInstance: logger })); app.listen(3000, () => { logger.info('Server running on port 3000'); }); This code sets up a robust logging system using Winston. It logs all HTTP requests and errors to both the console and files, making it easier to monitor and analyze application activities.

Join the 1M+ learners on CodeSignal

Be a part of our community of 1M+ users who develop and demonstrate their skills on CodeSignal

Structured Logging for Security Events

To make security logs more useful, it's important to use structured logging with consistent fields:

TypeScript

// Define security event types for consistency
enum SecurityEventType {
  AUTHENTICATION_FAILURE = 'authentication_failure',
  AUTHORIZATION_FAILURE = 'authorization_failure',
  INPUT_VALIDATION_FAILURE = 'input_validation_failure',
  POTENTIAL_SSRF_ATTEMPT = 'potential_ssrf_attempt',
  SENSITIVE_DATA_ACCESS = 'sensitive_data_access'
}

// Function to log security events with consistent structure
function logSecurityEvent(
  logger: winston.Logger, 
  eventType: SecurityEventType, 
  message: string, 
  metadata: Record<string, any>
) {
  logger.warn(message, {
    security_event_type: eventType,
    timestamp: new Date().toISOString(),
    ...metadata
  });
}

// Example usage in a route
app.post('/fetch-url', (req, res) => {
  const { url } = req.body;
  
  if (!url || typeof url !== 'string') {
    logSecurityEvent(logger, SecurityEventType.INPUT_VALIDATION_FAILURE, 'Invalid URL input', {
      ip: req.ip,
      input: url,
      user_id: req.user?.id, // Assuming you have user info in the request
      path: req.path
    });
    
    return res.status(400).json({ error: 'Invalid URL' });
  }
  
  // Check for potential SSRF attempt
  if (isSuspiciousUrl(url)) {
    logSecurityEvent(logger, SecurityEventType.POTENTIAL_SSRF_ATTEMPT, 'Potential SSRF attempt detected', {
      ip: req.ip,
      url: url,
      user_id: req.user?.id,
      user_agent: req.headers['user-agent']
    });
    
    return res.status(403).json({ error: 'Access denied' });
  }
  
  // Process the URL (securely)
  res.json({ success: true });
});

function isSuspiciousUrl(url: string): boolean {
  // Implement your SSRF detection logic here
  const suspiciousPatterns = ['localhost', '127.0.0.1', 'internal', '192.168.'];
  return suspiciousPatterns.some(pattern => url.includes(pattern));
}

// Define security event types for consistency
enum SecurityEventType {
  AUTHENTICATION_FAILURE = 'authentication_failure',
  AUTHORIZATION_FAILURE = 'authorization_failure',
  INPUT_VALIDATION_FAILURE = 'input_validation_failure',
  POTENTIAL_SSRF_ATTEMPT = 'potential_ssrf_attempt',
  SENSITIVE_DATA_ACCESS = 'sensitive_data_access'
}

// Function to log security events with consistent structure
function logSecurityEvent(
  logger: winston.Logger, 
  eventType: SecurityEventType, 
  message: string, 
  metadata: Record<string, any>
) {
  logger.warn(message, {
    security_event_type: eventType,
    timestamp: new Date().toISOString(),
    ...metadata
  });
}

// Example usage in a route
app.post('/fetch-url', (req, res) => {
  const { url } = req.body;
  
  if (!url || typeof url !== 'string') {
    logSecurityEvent(logger, SecurityEventType.INPUT_VALIDATION_FAILURE, 'Invalid URL input', {
      ip: req.ip,
      input: url,
      user_id: req.user?.id, // Assuming you have user info in the request
      path: req.path
    });
    
    return res.status(400).json({ error: 'Invalid URL' });
  }
  
  // Check for potential SSRF attempt
  if (isSuspiciousUrl(url)) {
    logSecurityEvent(logger, SecurityEventType.POTENTIAL_SSRF_ATTEMPT, 'Potential SSRF attempt detected', {
      ip: req.ip,
      url: url,
      user_id: req.user?.id,
      user_agent: req.headers['user-agent']
    });
    
    return res.status(403).json({ error: 'Access denied' });
  }
  
  // Process the URL (securely)
  res.json({ success: true });
});

function isSuspiciousUrl(url: string): boolean {
  // Implement your SSRF detection logic here
  const suspiciousPatterns = ['localhost', '127.0.0.1', 'internal', '192.168.'];
  return suspiciousPatterns.some(pattern => url.includes(pattern));
}

This approach ensures that security events are logged with consistent fields, making it easier to analyze and correlate events across your application.

Real-time Log Monitoring

Logging is only effective if someone is monitoring the logs. Let's implement a simple real-time monitoring system:

TypeScript

import express from 'express';
import http from 'http';
import { Server as SocketServer } from 'socket.io';
import winston from 'winston';

const app = express();
const server = http.createServer(app);
const io = new SocketServer(server);

// Configure Winston with a custom transport for Socket.io
class SocketTransport extends winston.Transport {
  constructor(opts?: winston.transport.TransportStreamOptions) {
    super(opts);
  }

  log(info: any, callback: () => void) {
    setImmediate(() => {
      this.emit('logged', info);
    });

    // Broadcast log to all connected clients
    io.emit('log-event', info);

    callback();
  }
}

// Create logger with Socket.io transport
const logger = winston.createLogger({
  level: 'info',
  format: winston.format.combine(
    winston.format.timestamp(),
    winston.format.json()
  ),
  transports: [
    new winston.transports.Console(),
    new winston.transports.File({ filename: 'combined.log' }),
    new SocketTransport()
  ]
});

// Socket.io connection handling
io.on('connection', (socket) => {
  console.log('Admin connected to log monitoring');
  
  socket.on('disconnect', () => {
    console.log('Admin disconnected from log monitoring');
  });
});

// Example route with security logging
app.get('/api/data', (req, res) => {
  logger.info('Data accessed', { ip: req.ip, path: req.path });
  res.json({ data: 'sensitive information' });
});

// Example route that triggers a security warning
app.post('/api/fetch', (req, res) => {
  const { url } = req.body;
  
  if (url && isSuspiciousUrl(url)) {
    logger.warn('Potential SSRF attempt', { 
      ip: req.ip,
      url,
      userAgent: req.headers['user-agent']
    });
    return res.status(403).json({ error: 'Access denied' });
  }
  
  res.json({ success: true });
});

function isSuspiciousUrl(url: string): boolean {
  // Implement SSRF detection logic
  return url.includes('internal') || url.includes('localhost');
}

// Simple admin dashboard to view logs in real-time
app.get('/admin/logs', (req, res) => {
  // In a real app, this would require authentication
  res.send(`
    <html>
      <head>
        <title>Security Log Monitor</title>
        <script src="/socket.io/socket.io.js"></script>
        <script>
          const socket = io();
          
          socket.on('log-event', (log) => {
            const logElement = document.createElement('div');
            logElement.textContent = JSON.stringify(log);
            logElement.className = log.level;
            document.getElementById('logs').prepend(logElement);
          });
        </script>
        <style>
          .warn, .error { color: red; font-weight: bold; }
          .info { color: blue; }
          #logs { max-height: 500px; overflow-y: auto; }
        </style>
      </head>
      <body>
        <h1>Security Log Monitor</h1>
        <div id="logs"></div>
      </body>
    </html>
  `);
});

server.listen(3000, () => {
  logger.info('Server running on port 3000');
});

import express from 'express';
import http from 'http';
import { Server as SocketServer } from 'socket.io';
import winston from 'winston';

const app = express();
const server = http.createServer(app);
const io = new SocketServer(server);

// Configure Winston with a custom transport for Socket.io
class SocketTransport extends winston.Transport {
  constructor(opts?: winston.transport.TransportStreamOptions) {
    super(opts);
  }

  log(info: any, callback: () => void) {
    setImmediate(() => {
      this.emit('logged', info);
    });

    // Broadcast log to all connected clients
    io.emit('log-event', info);

    callback();
  }
}

// Create logger with Socket.io transport
const logger = winston.createLogger({
  level: 'info',
  format: winston.format.combine(
    winston.format.timestamp(),
    winston.format.json()
  ),
  transports: [
    new winston.transports.Console(),
    new winston.transports.File({ filename: 'combined.log' }),
    new SocketTransport()
  ]
});

// Socket.io connection handling
io.on('connection', (socket) => {
  console.log('Admin connected to log monitoring');
  
  socket.on('disconnect', () => {
    console.log('Admin disconnected from log monitoring');
  });
});

// Example route with security logging
app.get('/api/data', (req, res) => {
  logger.info('Data accessed', { ip: req.ip, path: req.path });
  res.json({ data: 'sensitive information' });
});

// Example route that triggers a security warning
app.post('/api/fetch', (req, res) => {
  const { url } = req.body;
  
  if (url && isSuspiciousUrl(url)) {
    logger.warn('Potential SSRF attempt', { 
      ip: req.ip,
      url,
      userAgent: req.headers['user-agent']
    });
    return res.status(403).json({ error: 'Access denied' });
  }
  
  res.json({ success: true });
});

function isSuspiciousUrl(url: string): boolean {
  // Implement SSRF detection logic
  return url.includes('internal') || url.includes('localhost');
}

// Simple admin dashboard to view logs in real-time
app.get('/admin/logs', (req, res) => {
  // In a real app, this would require authentication
  res.send(`
    <html>
      <head>
        <title>Security Log Monitor</title>
        <script src="/socket.io/socket.io.js"></script>
        <script>
          const socket = io();
          
          socket.on('log-event', (log) => {
            const logElement = document.createElement('div');
            logElement.textContent = JSON.stringify(log);
            logElement.className = log.level;
            document.getElementById('logs').prepend(logElement);
          });
        </script>
        <style>
          .warn, .error { color: red; font-weight: bold; }
          .info { color: blue; }
          #logs { max-height: 500px; overflow-y: auto; }
        </style>
      </head>
      <body>
        <h1>Security Log Monitor</h1>
        <div id="logs"></div>
      </body>
    </html>
  `);
});

server.listen(3000, () => {
  logger.info('Server running on port 3000');
});

This implementation uses Socket.io to broadcast log events to a simple admin dashboard, allowing for real-time monitoring of security events.

Setting Up Alerts Based on Log Patterns

To proactively respond to security events, we can set up alerts based on specific log patterns:

import express from 'express';
import winston from 'winston';
import nodemailer from 'nodemailer';

const app = express();
app.use(express.json());

// Configure email transporter
const transporter = nodemailer.createTransport({
  service: 'gmail',
  auth: {
    user: process.env.EMAIL_USER || 'your-email@gmail.com',
    pass: process.env.EMAIL_PASSWORD || 'your-email-password'
  }
});

// Class to handle alerts based on log patterns
class LogAlerter {
  private alertThresholds: Map<string, {
    count: number,
    timeWindow: number,
    lastAlert: number
  }> = new Map();
  
  private logger: winston.Logger;
  
  constructor(logger: winston.Logger) {
    this.logger = logger;
    
    // Set up alert thresholds for different event types
    this.alertThresholds.set('potential_ssrf_attempt', {
      count: 3,  // Alert after 3 attempts
      timeWindow: 10 * 60 * 1000,  // Within 10 minutes
      lastAlert: 0
    });
    
    this.alertThresholds.set('authentication_failure', {
      count: 5,  // Alert after 5 failures
      timeWindow: 15 * 60 * 1000,  // Within 15 minutes
      lastAlert: 0
    });
    
    // Set up event listener for log events
    this.setupEventListener();
  }
  
  private setupEventListener() {
    // Count events by type within time windows
    const eventCounts: Map<string, { timestamp: number, ip: string }[]> = new Map();
    
    this.logger.on('logged', (info) => {
      if (info.security_event_type) {
        const eventType = info.security_event_type;
        
        // Initialize event count array if needed
        if (!eventCounts.has(eventType)) {
          eventCounts.set(eventType, []);
        }
        
        // Add event to the count
        const events = eventCounts.get(eventType)!;
        events.push({
          timestamp: Date.now(),
          ip: info.ip || 'unknown'
        });
        
        // Check if we need to send an alert
        this.checkAlertThreshold(eventType, events);
      }
    });
  }
  
  private checkAlertThreshold(eventType: string, events: { timestamp: number, ip: string }[]) {
    const threshold = this.alertThresholds.get(eventType);
    if (!threshold) return;
    
    const now = Date.now();
    
    // Filter events within the time window
    const recentEvents = events.filter(e => e.timestamp > now - threshold.timeWindow);
    
    // Update event list to only include recent events
    events.length = 0;
    events.push(...recentEvents);
    
    // Check if we've hit the threshold and it's been long enough since the last alert
    if (recentEvents.length >= threshold.count && 
        now - threshold.lastAlert > threshold.timeWindow) {
      
      // Group by IP address to see if there's a pattern
      const ipCounts = new Map<string, number>();
      recentEvents.forEach(e => {
        ipCounts.set(e.ip, (ipCounts.get(e.ip) || 0) + 1);
      });
      
      // Find the IP with the most events
      let maxIP = '';
      let maxCount = 0;
      ipCounts.forEach((count, ip) => {
        if (count > maxCount) {
          maxCount = count;
          maxIP = ip;
        }
      });
      
      // Send the alert
      this.sendAlert(eventType, recentEvents.length, maxIP, maxCount);
      
      // Update last alert timestamp
      threshold.lastAlert = now;
    }
  }
  
  private sendAlert(eventType: string, totalCount: number, mainIP: string, ipCount: number) {
    const subject = `SECURITY ALERT: ${this.formatEventType(eventType)}`;
    const message = `
      We detected ${totalCount} instances of ${this.formatEventType(eventType)} in the last few minutes.
      
      The primary source appears to be IP: ${mainIP} (${ipCount} events).
      
      Please investigate immediately.
    `;
    
    // Log the alert
    this.logger.error(subject, { totalCount, mainIP, ipCount, eventType });
    
    // Send email alert
    transporter.sendMail({
      from: process.env.EMAIL_USER || 'your-email@gmail.com',
      to: process.env.ADMIN_EMAIL || 'admin@example.com',
      subject,
      text: message
    }, (error, info) => {
      if (error) {
        this.logger.error(`Failed to send alert email: ${error.message}`);
      } else {
        this.logger.info(`Alert email sent: ${info.response}`);
      }
    });
  }
  
  private formatEventType(eventType: string): string {
    return eventType
      .replace(/_/g, ' ')
      .replace(/\b\w/g, char => char.toUpperCase());
  }
}

// Create logger
const logger = winston.createLogger({
  level: 'info',
  format: winston.format.combine(
    winston.format.timestamp(),
    winston.format.json()
  ),
  transports: [
    new winston.transports.Console(),
    new winston.transports.File({ filename: 'security.log' })
  ]
});

// Initialize the log alerter
const alerter = new LogAlerter(logger);

// Example route with security logging
app.post('/api/fetch', (req, res) => {
  const { url } = req.body;
  
  if (url && isSuspiciousUrl(url)) {
    logger.warn('Potential SSRF attempt detected', { 
      security_event_type: 'potential_ssrf_attempt',
      ip: req.ip,
      url,
      userAgent: req.headers['user-agent']
    });
    return res.status(403).json({ error: 'Access denied' });
  }
  
  res.json({ success: true });
});

function isSuspiciousUrl(url: string): boolean {
  return url.includes('internal') || url.includes('localhost');
}

app.listen(3000, () => {
  logger.info('Server running on port 3000');
});

This implementation sets up a sophisticated alerting system that monitors log patterns and sends alerts when certain thresholds are exceeded, helping you respond quickly to potential security incidents.