GuardAPI Logo
GuardAPI

Fix Insufficient Logging & Monitoring in Hapi

Insufficient logging is an invitation for persistence. In Hapi, if you aren't capturing lifecycle events, 4xx/5xx spikes, and authentication failures, you are effectively blind to post-exploitation. Standard Hapi setups are too quiet; you need structured, high-velocity telemetry to detect credential stuffing and lateral movement.

The Vulnerable Pattern

const Hapi = require('@hapi/hapi');

const init = async () => {
const server = Hapi.server({ port: 3000 });


server.route({
    method: 'POST',
    path: '/api/login',
    handler: (request, h) => {
        const { username, password } = request.payload;
        // VULNERABILITY: No logging of failed attempts, IP metadata, or session context
        if (username !== 'admin' || password !== 'p@ssword') {
            return h.response({ message: 'Invalid' }).code(401);
        }
        return { token: 'jwt_token_here' };
    }
});

await server.start();


};
init();

The Secure Implementation

The fix transitions from 'silent failure' to 'structured telemetry'. By integrating `hapi-pino`, we ensure every request is tracked with a unique ID and source IP. Crucially, we use `request.log()` to tag security events like failed logins, allowing SIEMs to trigger alerts on threshold breaches. The `redact` option is mandatory to prevent sensitive credentials from leaking into your log aggregator (ELK/Splunk), fulfilling both visibility and compliance requirements.

const Hapi = require('@hapi/hapi');
const pino = require('hapi-pino');

const init = async () => {
const server = Hapi.server({ port: 3000 });


// Register hapi-pino for structured logging
await server.register({
    plugin: pino,
    options: {
        redact: ['payload.password', 'req.headers.authorization'],
        logPayload: true,
        getChildBindings: (req) => ({
            remoteAddress: req.info.remoteAddress,
            requestId: req.info.id
        })
    }
});

server.route({
    method: 'POST',
    path: '/api/login',
    handler: (request, h) => {
        const { username, password } = request.payload;
        
        if (username !== 'admin' || password !== 'p@ssword') {
            // SECURE: Explicitly log security event with context
            request.log(['auth', 'security', 'failure'], {
                msg: 'Unauthorized login attempt',
                user: username,
                severity: 'high'
            });
            return h.response({ message: 'Invalid' }).code(401);
        }
        
        request.log(['auth', 'security', 'success'], { user: username });
        return { token: 'jwt_token_here' };
    }
});

await server.start();


};
init();

System Alert • ID: 5993
Target: Hapi API
Potential Vulnerability

Your Hapi API might be exposed to Insufficient Logging & Monitoring

74% of Hapi apps fail this check. Hackers use automated scanners to find this specific flaw. Check your codebase before they do.

RUN FREE SECURITY DIAGNOSTIC
GuardLabs Engine: ONLINE

Free Tier • No Credit Card • Instant Report

Verified by Ghost Labs Security Team

This content is continuously validated by our automated security engine and reviewed by our research team. Ghost Labs analyzes over 500+ vulnerability patterns across 40+ frameworks to provide up-to-date remediation strategies.

About GuardLabs → Follow us on X