Fix Insufficient Logging & Monitoring in RedwoodJS

RedwoodJS defaults are optimized for developer experience, but they leave your production environment blind to adversarial activity if you don't explicitly configure structured logging. Insufficient logging (OWASP A09:2021) in a Redwood app typically manifests as silent GraphQL errors or unrecorded administrative actions. To defend the stack, you must leverage the built-in Pino-based logger to create an immutable audit trail of authentication events, authorization failures, and high-value mutations.

The Vulnerable Pattern

// api/src/services/posts/posts.js
export const deletePost = ({ id }) => {
  // VULNERABLE: Silent execution. No record of who deleted the post or if it failed.
  // An attacker could iterate IDs (IDOR) and wipe the DB without leaving a trace in the logs.
  return db.post.delete({
    where: { id },
  })
}

The Secure Implementation

The secure implementation moves away from 'silent' services. By importing the Redwood 'logger' (which uses Pino), we inject structured JSON data into the log stream. Key improvements: 1) Contextual awareness: We log the 'currentUser' from the Redwood global context to identify the actor. 2) Structured Metadata: Using the 'custom' object ensures that log aggregators (like ELK or Datadog) can index 'actorId' and 'action' fields for alerting. 3) Differentiated Levels: We use 'logger.info' for successful audits and 'logger.warn' or 'logger.error' for failed attempts, which is critical for detecting credential stuffing or IDOR probing.

// api/src/services/posts/posts.js
import { logger } from 'src/lib/logger'
export const deletePost = async ({ id }) => {
const { currentUser } = context
try {
const result = await db.post.delete({
where: { id },
})
// SECURE: Structured logging with actor context and action metadata
logger.info(
  { 
    custom: { 
      action: 'POST_DELETE', 
      actorId: currentUser?.id, 
      postId: id, 
      status: 'SUCCESS' 
    } 
  }, 
  `Post ${id} deleted by user ${currentUser?.id}`
)
return result
} catch (error) {
logger.warn(
{
err: error,
custom: {
action: ‘POST_DELETE’,
actorId: currentUser?.id,
postId: id,
status: ‘FAILURE’
}
},
‘Unauthorized or failed post deletion attempt’
)
throw error
}
}