OWASP A09: Security Logging and Alerting Failures — What to Log, What Never to Log
We start with a login endpoint that writes wrong passwords to the log, lets a line break forge a record and never records 403s. We move to structured logging with LoggerMessage and the JSON console, make authorization denials visible, protect the email with HMAC redaction, tie the response to the log through traceId and look at which events deserve an alert.
6 Nov 2026
·
8 min
·
12
