Security Logging and Monitoring

Introduction

Welcome to the final lesson in our Server-Side Request Forgery (SSRF) Prevention in Java Web Applications course! In this lesson, we'll explore security logging and monitoring using Spring Boot. Effective logging and monitoring are crucial components of a comprehensive security strategy, as they help you detect, investigate, and respond to security incidents promptly. Let's dive in and discover how to implement these practices in your Spring Boot applications! 📊

The Role of Security Logging

Security logging is the practice of recording events related to security concerns within your application. Properly implemented logs serve multiple purposes: Detecting Security Incidents : Logs can reveal suspicious activities that may indicate ongoing attacks. Investigating Breaches : After a security incident, logs provide valuable data for forensic analysis. Compliance Requirements : Many regulatory frameworks require specific logging practices. System Auditing : Logs help track user activities and system changes over time. Let's implement a comprehensive logging system using Spring Boot with SLF4J and Logback (which Spring Boot includes by default).

Setting Up Request Logging with Spring Boot Filters

Spring Boot makes it easy to create filters for logging HTTP requests. Here's how to implement a request logging filter: Java import org.slf4j.Logger; import org.slf4j.LoggerFactory; import org.springframework.stereotype.Component; import org.springframework.web.filter.OncePerRequestFilter; import jakarta.servlet.FilterChain; import jakarta.servlet.ServletException; import jakarta.servlet.http.HttpServletRequest; import jakarta.servlet.http.HttpServletResponse; import java.io.IOException; @Component public class RequestLoggingFilter extends OncePerRequestFilter {private static final Logger logger = LoggerFactory.getLogger(RequestLoggingFilter.class); @Override protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException {logger.info("HTTP {} {} from IP {}", request.getMethod(), request.getRequestURI(), request.getRemoteAddr()); // Log potentially suspicious activities String urlParam = request.getParameter("url"); if (urlParam != null) {logger.warn("URL parameter detected: {} from IP {}", urlParam, request.getRemoteAddr());} filterChain.doFilter(request, response);}} Key Spring Boot Features: @Component automatically registers the filter with Spring Boot OncePerRequestFilter ensures the filter executes once per request jakarta.servlet.* imports (Spring Boot 3.x uses Jakarta EE)

Join the 1M+ learners on CodeSignal

Be a part of our community of 1M+ users who develop and demonstrate their skills on CodeSignal

XML

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
    <!-- Console appender for development -->
    <appender name="CONSOLE" class="ch.qos.logback.core.ConsoleAppender">
        <encoder>
            <pattern>%d{HH:mm:ss.SSS} [%thread] %-5level %logger{36} - %msg%n</pattern>
        </encoder>
    </appender>

    <!-- File appender for all logs -->
    <appender name="FILE" class="ch.qos.logback.core.FileAppender">
        <file>logs/application.log</file>
        <append>true</append>
        <encoder>
            <pattern>%d{yyyy-MM-dd HH:mm:ss.SSS} [%thread] %-5level %logger{36} - %msg%n</pattern>
        </encoder>
    </appender>

    <!-- Separate file for security events -->
    <appender name="SECURITY" class="ch.qos.logback.core.FileAppender">
        <file>logs/security.log</file>
        <filter class="ch.qos.logback.classic.filter.ThresholdFilter">
            <level>WARN</level>
        </filter>
        <encoder>
            <pattern>%d{yyyy-MM-dd HH:mm:ss.SSS} [%thread] %-5level %logger{36} - %msg%n</pattern>
        </encoder>
    </appender>

    <!-- Optional: Package-specific logging level -->
    <logger name="com.codesignal.app" level="INFO" additivity="false">
        <appender-ref ref="CONSOLE"/>
        <appender-ref ref="FILE"/>
        <appender-ref ref="SECURITY"/>
    </logger>

    <root level="INFO">
        <appender-ref ref="CONSOLE"/>
        <appender-ref ref="FILE"/>
        <appender-ref ref="SECURITY"/>
    </root>
</configuration>

Java

import org.slf4j.Logger;
import org.springframework.stereotype.Service;

import java.time.Instant;
import java.util.Map;

@Service
public class SecurityLogger {
    
    public void logSecurityEvent(
            Logger logger,
            SecurityEventType eventType,
            String message,
            Map<String, Object> metadata
    ) {
        StringBuilder logEntry = new StringBuilder();
        logEntry.append(message);
        logEntry.append(" - security_event_type=").append(eventType);
        logEntry.append(", timestamp=").append(Instant.now().toString());
        
        if (metadata != null) {
            metadata.forEach((key, value) -> 
                logEntry.append(", ").append(key).append("=").append(value)
            );
        }
        
        logger.warn(logEntry.toString());
    }
}

Java

public enum SecurityEventType {
    AUTHENTICATION_FAILURE,
    AUTHORIZATION_FAILURE,
    INPUT_VALIDATION_FAILURE,
    POTENTIAL_SSRF_ATTEMPT,
    SENSITIVE_DATA_ACCESS
}

Java

import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.http.HttpStatus;
import org.springframework.http.ResponseEntity;
import org.springframework.web.bind.annotation.*;

import jakarta.servlet.http.HttpServletRequest;
import java.util.HashMap;
import java.util.Map;

@RestController
public class FetchUrlController {
    
    private static final Logger logger = LoggerFactory.getLogger(FetchUrlController.class);
    
    @Autowired
    private SecurityLogger securityLogger;

    @PostMapping("/api/fetch")
    public ResponseEntity<Map<String, Object>> fetchUrl(
            @RequestBody Map<String, String> requestBody,
            HttpServletRequest request) {
        
        String url = requestBody.get("url");

        if (url == null || url.isEmpty()) {
            Map<String, Object> metadata = new HashMap<>();
            metadata.put("ip", request.getRemoteAddr());
            metadata.put("input", url);
            metadata.put("path", request.getRequestURI());
            
            securityLogger.logSecurityEvent(
                logger,
                SecurityEventType.INPUT_VALIDATION_FAILURE,
                "Invalid URL input",
                metadata
            );
            
            return ResponseEntity.status(HttpStatus.BAD_REQUEST)
                               .body(Map.of("error", "Invalid URL"));
        }

        if (isSuspiciousUrl(url)) {
            Map<String, Object> metadata = new HashMap<>();
            metadata.put("ip", request.getRemoteAddr());
            metadata.put("url", url);
            metadata.put("user_agent", request.getHeader("User-Agent"));
            
            securityLogger.logSecurityEvent(
                logger,
                SecurityEventType.POTENTIAL_SSRF_ATTEMPT,
                "Potential SSRF attempt detected",
                metadata
            );
            
            return ResponseEntity.status(HttpStatus.FORBIDDEN)
                               .body(Map.of("error", "Access denied"));
        }

        return ResponseEntity.ok(Map.of("success", true));
    }

    private boolean isSuspiciousUrl(String url) {
        String[] suspiciousPatterns = {"localhost", "127.0.0.1", "internal", "192.168."};
        for (String pattern : suspiciousPatterns) {
            if (url.contains(pattern)) return true;
        }
        return false;
    }
}

XML

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-websocket</artifactId>
</dependency>

Java

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.web.socket.server.standard.ServerEndpointExporter;

@Configuration
public class WebSocketConfig {

    @Bean
    public ServerEndpointExporter serverEndpointExporter() {
        return new ServerEndpointExporter();
    }
}

Java

import org.springframework.stereotype.Component;

import jakarta.websocket.*;
import jakarta.websocket.server.ServerEndpoint;
import java.io.IOException;
import java.util.Set;
import java.util.concurrent.CopyOnWriteArraySet;

@ServerEndpoint("/ws/logs")
@Component
public class LogWebSocketEndpoint {
    
    private static Set<Session> sessions = new CopyOnWriteArraySet<>();

    @OnOpen
    public void onOpen(Session session) {
        sessions.add(session);
    }

    @OnClose
    public void onClose(Session session) {
        sessions.remove(session);
    }

    @OnError
    public void onError(Session session, Throwable throwable) {
        sessions.remove(session);
    }

    public static void broadcast(String message) {
        sessions.forEach(session -> {
            if (session.isOpen()) {
                try {
                    session.getBasicRemote().sendText(message);
                } catch (IOException e) {
                    // Handle error silently
                }
            }
        });
    }
}

Java

import ch.qos.logback.classic.spi.ILoggingEvent;
import ch.qos.logback.core.AppenderBase;
import com.fasterxml.jackson.databind.ObjectMapper;

import java.util.HashMap;
import java.util.Map;

public class WebSocketLogAppender extends AppenderBase<ILoggingEvent> {
    
    private final ObjectMapper objectMapper = new ObjectMapper();

    @Override
    protected void append(ILoggingEvent eventObject) {
        try {
            Map<String, Object> logEvent = new HashMap<>();
            logEvent.put("timestamp", eventObject.getTimeStamp());
            logEvent.put("level", eventObject.getLevel().toString());
            logEvent.put("logger", eventObject.getLoggerName());
            logEvent.put("message", eventObject.getFormattedMessage());
            logEvent.put("thread", eventObject.getThreadName());
            
            String jsonLog = objectMapper.writeValueAsString(logEvent);
            LogWebSocketEndpoint.broadcast(jsonLog);
        } catch (Exception e) {
            addError("Failed to broadcast log event", e);
        }
    }
}

XML

<appender name="WEBSOCKET" class="com.codesignal.app.WebSocketLogAppender"/>

<root level="INFO">
    <appender-ref ref="CONSOLE"/>
    <appender-ref ref="FILE"/>
    <appender-ref ref="WEBSOCKET"/>
</root>

Java

import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.ResponseBody;

@Controller
public class LogAdminController {

    @GetMapping("/admin/logs")
    @ResponseBody
    public String adminLogs() {
        return """
            <!DOCTYPE html>
            <html>
              <head>
                <title>Security Log Monitor</title>
                <script>
                  let socket;
                  window.onload = function() {
                    const protocol = window.location.protocol === 'https:' ? 'wss:' : 'ws:';
                    socket = new WebSocket(protocol + '//' + window.location.host + '/ws/logs');
                    
                    socket.onmessage = function(event) {
                      const log = JSON.parse(event.data);
                      const logElement = document.createElement('div');
                      logElement.textContent = JSON.stringify(log);
                      logElement.className = log.level.toLowerCase();
                      document.getElementById('logs').prepend(logElement);
                    };
                    
                    socket.onerror = function(error) {
                      console.error('WebSocket error:', error);
                    };
                  };
                </script>
                <style>
                  .warn, .error { color: red; font-weight: bold; }
                  .info { color: blue; }
                  #logs { max-height: 500px; overflow-y: auto; }
                </style>
              </head>
              <body>
                <h1>Security Log Monitor</h1>
                <div id="logs"></div>
              </body>
            </html>
            """;
    }
}

XML

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-mail</artifactId>
</dependency>

INI

spring.mail.host=smtp.gmail.com
spring.mail.port=587
spring.mail.username=${EMAIL_USER}
spring.mail.password=${EMAIL_PASSWORD}
spring.mail.properties.mail.smtp.auth=true
spring.mail.properties.mail.smtp.starttls.enable=true

Java

import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.mail.SimpleMailMessage;
import org.springframework.mail.javamail.JavaMailSender;
import org.springframework.scheduling.annotation.Scheduled;
import org.springframework.stereotype.Service;

import java.time.LocalDateTime;
import java.util.*;
import java.util.concurrent.ConcurrentHashMap;

@Service
public class LogAlerter {
    private static final Logger logger = LoggerFactory.getLogger(LogAlerter.class);

    @Autowired
    private JavaMailSender mailSender;
    
    @Value("${admin.email:admin@example.com}")
    private String adminEmail;
    
    @Value("${spring.mail.username}")
    private String fromEmail;

    private final Map<SecurityEventType, List<Long>> eventTimestamps = new ConcurrentHashMap<>();
    private final Map<SecurityEventType, Long> lastAlert = new ConcurrentHashMap<>();

    // Configuration thresholds
    private final int ssrfThreshold = 3;
    private final long ssrfWindowMillis = 10 * 60 * 1000; // 10 minutes

    public void recordEvent(SecurityEventType type) {
        eventTimestamps.computeIfAbsent(type, k -> Collections.synchronizedList(new ArrayList<>()))
                      .add(System.currentTimeMillis());
    }

    @Scheduled(fixedRate = 60000) // Check every minute
    public void checkAlerts() {
        long now = System.currentTimeMillis();
        
        // Check SSRF attempt pattern
        List<Long> ssrfEvents = eventTimestamps.getOrDefault(
            SecurityEventType.POTENTIAL_SSRF_ATTEMPT, 
            new ArrayList<>()
        );
        
        // Remove old events outside the time window
        ssrfEvents.removeIf(ts -> ts < now - ssrfWindowMillis);

        // Check if threshold is exceeded and we haven't alerted recently
        if (ssrfEvents.size() >= ssrfThreshold &&
            (lastAlert.getOrDefault(SecurityEventType.POTENTIAL_SSRF_ATTEMPT, 0L) 
             < now - ssrfWindowMillis)) {
            
            sendAlert(SecurityEventType.POTENTIAL_SSRF_ATTEMPT, ssrfEvents.size());
            lastAlert.put(SecurityEventType.POTENTIAL_SSRF_ATTEMPT, now);
        }
    }

    private void sendAlert(SecurityEventType type, int count) {
        String subject = "SECURITY ALERT: " + type.name().replace("_", " ");
        String body = String.format(
            "Detected %d instances of %s in the last 10 minutes.\n" +
            "Please investigate immediately.\n\n" +
            "Timestamp: %s",
            count, type.name(), LocalDateTime.now()
        );

        try {
            SimpleMailMessage message = new SimpleMailMessage();
            message.setFrom(fromEmail);
            message.setTo(adminEmail);
            message.setSubject(subject);
            message.setText(body);
            
            mailSender.send(message);
            logger.error("Alert sent: {}", subject);
        } catch (Exception e) {
            logger.error("Failed to send alert email", e);
        }
    }
}

Java

import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.scheduling.annotation.EnableScheduling;

@SpringBootApplication
@EnableScheduling
public class Application {
    public static void main(String[] args) {
        SpringApplication.run(Application.class, args);
    }
}

Java

@RestController
public class SecureController {
    
    @Autowired
    private LogAlerter alerter;
    
    @PostMapping("/api/secure-action")
    public ResponseEntity<?> secureAction(@RequestBody Map<String, String> data) {
        if (isSuspicious(data)) {
            // Record the event for alerting
            alerter.recordEvent(SecurityEventType.POTENTIAL_SSRF_ATTEMPT);
            return ResponseEntity.status(HttpStatus.FORBIDDEN)
                               .body(Map.of("error", "Access denied"));
        }
        
        return ResponseEntity.ok(Map.of("success", true));
    }
    
    private boolean isSuspicious(Map<String, String> data) {
        // Your validation logic
        return false;
    }
}

Introduction

The Role of Security Logging

Setting Up Request Logging with Spring Boot Filters

Join the 1M+ learners on CodeSignal

Configuring Logback in Spring Boot

Structured Logging for Security Events

1. Add WebSocket Dependency

2. Configure WebSocket

3. Create WebSocket Endpoint

4. Create Custom Logback Appender

5. Register Appender in logback-spring.xml

6. Create Admin Dashboard Controller

Pattern-Based Alerting System with Spring Boot

Configure Spring Boot Mail

Enhanced Log Alerter Service

Enable Scheduling

Integration Example

Conclusion