import cherrypy
class VulnerableApp:
@cherrypy.expose
def login(self, username, password):
# FAIL: No logging of login attempts.
# If an attacker brute-forces this, there is no record in the logs.
if username == ‘admin’ and password == ‘password123’:
return ‘Welcome’
return ‘Access Denied’
if name == ‘main’:
# FAIL: Default config only logs to stdout/stderr; no persistent log files or rotation.
cherrypy.quickstart(VulnerableApp())

import cherrypy
import logging
from logging.handlers import RotatingFileHandler
Configure structured logging with rotation
log_handler = RotatingFileHandler(‘security.log’, maxBytes=1000000, backupCount=5)
log_handler.setFormatter(logging.Formatter(’%(asctime)s - %(levelname)s - %(message)s’))
class SecuredApp:
@cherrypy.expose
def login(self, username, password):
client_ip = cherrypy.request.remote.ip
if username == ‘admin’ and password == ‘password123’:
cherrypy.log(f”AUTH_SUCCESS: User {username} logged in from {client_ip}”, severity=logging.INFO)
return ‘Welcome’
    # SECURE: Log failed attempts with metadata for SIEM/Fail2Ban ingestion
    cherrypy.log(f"AUTH_FAILURE: Failed login attempt for {username} from {client_ip}", severity=logging.WARNING)
    raise cherrypy.HTTPError(401, "Unauthorized")
config = {
‘global’: {
‘log.screen’: False,
‘log.access_file’: ‘access.log’,
‘log.error_file’: ‘error.log’,
‘request.show_tracebacks’: False
}
}
if name == ‘main’:
app = cherrypy.tree.mount(SecuredApp(), ’/’, config)
app.log.error_log.addHandler(log_handler)
cherrypy.engine.start()
cherrypy.engine.block()