Fix Insufficient Logging & Monitoring in Hanami
Insufficient logging is a silent killer. In Hanami, relying on default Rack logs leaves you blind to application-layer attacks like IDOR or brute-force. To defend the stack, you must implement structured, semantic logging that captures security-relevant context without leaking PII.
The Vulnerable Pattern
class Web::Actions::Sessions::Create include Web::Action
def handle(req, res) user = UserRepository.new.find_by_email(req.params[:email]) if user && user.password == req.params[:password] res.session[:user_id] = user.id res.redirect_to ‘/dashboard’ else # VULNERABILITY: No log entry generated for failed login attempts. # Attackers can brute force without triggering any alerts. res.status = 401 end end end
The Secure Implementation
The fix involves three pillars: 1. Structured Logging: Using JSON format allows SIEMs (like ELK or Splunk) to parse and alert on specific keys. 2. Explicit Security Events: Manually logging 'auth.failure' with the source IP and target email enables the detection of credential stuffing. 3. Parameter Filtering: The 'filter_params' configuration ensures sensitive data is redacted from logs, preventing a secondary data breach via log files. Always log the 'who, what, when, and where' for every sensitive state change.
class Web::Actions::Sessions::Create include Web::Actiondef handle(req, res) user = UserRepository.new.find_by_email(req.params[:email]) if user && BCrypt::Password.new(user.password_hash) == req.params[:password] Hanami.logger.info(event: ‘auth.success’, user_id: user.id, remote_ip: req.ip) res.session[:user_id] = user.id res.redirect_to ‘/dashboard’ else # SECURE: Explicitly log failures with context for SIEM monitoring Hanami.logger.warn(event: ‘auth.failure’, target_email: req.params[:email], remote_ip: req.ip) res.status = 401 end end end
In config/app.rb
config.logger.formatter = :json config.logger.filter_params = [:password, :token, :secret]
Your Hanami API
might be exposed to Insufficient Logging & Monitoring
74% of Hanami apps fail this check. Hackers use automated scanners to find this specific flaw. Check your codebase before they do.
Free Tier • No Credit Card • Instant Report
Verified by Ghost Labs Security Team
This content is continuously validated by our automated security engine and reviewed by our research team. Ghost Labs analyzes over 500+ vulnerability patterns across 40+ frameworks to provide up-to-date remediation strategies.