Log successful and failed login attempts #2347
Conversation
| authenticated = True | ||
|
|
||
| elif hmac.compare_digest(request.args.get(DATA_API_PASSWORD, ''), | ||
| self.hass.wsgi.api_password): | ||
| _LOGGER.info('Successful login from %s', request.remote_addr) |
There was a problem hiding this comment.
Instead of repeating the same log message three times with the risk of them getting out of sync, let's add it before the if self.requires_auth line:
if authenticated:
_LOGGER.info(…)
elif self.requires_auth:
_LOGGER.warning(…)
raise Unauthorized()
|
Looks good. Can be merged when linting error addressed 🐬 |
|
I only realize now that this adds a lot of logging. I wonder if we should reduce the visibility of the logging? Although, that might also not be useful. I don't know. |
|
I wonder if it would be better to add a config option so this could be turned off? |
|
Perhaps we should get rid for the additional log entries for 200 responses. One would still be able to spot easily failed login attempts and the entry for 200 responses only need a little more parsing if those details matters. |
|
Another option would be to default the http component logging to a higher level, like @philhawthorne to turn off/down you can try this logger:
logs:
homeassistant.components.http: critical |
|
The logging trick works but we shouldn't be broken (or spamming) by On Wed, Jun 29, 2016, 07:41 Johann Kellerman [email protected]
|
|
New CherryPy wsgi server doesn't print any url so we could print the url On Wed, Jun 29, 2016, 09:07 Paulus Schoutsen [email protected]
|
Description:
This is basically the same feature which was introduced with #1558. Instead of only showing:
16-06-21 21:31:35 INFO (WSGI-server) [homeassistant.components.http] 127.0.0.1 - - [21/Jun/2016 21:31:35] "GET /api/bootstrap HTTP/1.1" 200 14754 0.001991and
16-06-21 21:51:35 INFO (WSGI-server) [homeassistant.components.http] 127.0.0.1 - - [21/Jun/2016 21:51:35] "GET /api/bootstrap HTTP/1.1" 401 186 0.001866There will be a human-readable log entry with the source additionally to the 200/401 HTTP message.
or
Example entry for
configuration.yaml(if applicable):http:Checklist:
If the code does not interact with devices:
toxrun successfully. Your PR cannot be merged unless tests pass