3
Feature request: Include user email in successful login logs
Source: dani-garcia/vaultwarden#7418 · opened by @lmogthb
Description Vaultwarden currently logs failed and successful login attempts using different user identifiers. A failed login is logged as: A successful login is logged as: A successful login via API KEY already logs the email, but not the above ones This makes it difficult to correlate failed and successful authentication events in SIEM platforms, since one event uses the email address while the other uses the display name. Why this is a problem From a security monitoring perspective, email addresses are the most stable user identifier. Display names: • Can contain spaces. • Can be modified by users. • Are not guaranteed to be unique. • Are difficult to correlate with previous failed login attempts. As a result, detecting scenarios such as: • Multiple failed logins against an account followed by a successful login. • Credential stuffing. • Brute-force attacks. • Account compromise. become…
No pledges yet. Be the first to back this.
Comments
Similar requests
Feature Request: Audit logging for successful personal vault logins
2 votes · 0 comments
Feature: Auto-provision new users on first SSO login (no manual admin invite required)
1 vote · 0 comments
Feature Request: Ability to Disable a Login Without Deleting It (Hide from Autofill Suggestions)
2 votes · 0 comments
Login with device cannot be used to unlock vault on page refresh
1 vote · 0 comments
SSO login flow requires redundant email input before IdP redirect
3 votes · 0 comments
No comments yet.