FeatureFuel
3

Feature request: Include user email in successful login logs

Source: dani-garcia/vaultwarden#7418 · opened by @lmogthb
Description Vaultwarden currently logs failed and successful login attempts using different user identifiers. A failed login is logged as: A successful login is logged as: A successful login via API KEY already logs the email, but not the above ones This makes it difficult to correlate failed and successful authentication events in SIEM platforms, since one event uses the email address while the other uses the display name. Why this is a problem From a security monitoring perspective, email addresses are the most stable user identifier. Display names: • Can contain spaces. • Can be modified by users. • Are not guaranteed to be unique. • Are difficult to correlate with previous failed login attempts. As a result, detecting scenarios such as: • Multiple failed logins against an account followed by a successful login. • Credential stuffing. • Brute-force attacks. • Account compromise. become…

No pledges yet. Be the first to back this.

Make a pledge

Pledge your monetary support if this feature is added.

$

Comments

No comments yet.

Replying to

Add a comment

What do you think about this feature request?


Similar requests