Audit logging of failed payment attempts for security monitoring

Failed payment attempts are the primary signal for detecting carding attacks, credential stuffing, and account takeover attempts on your checkout. Without server-side audit logs, you cannot identify patterns — for example, 500 failed attempts against different card numbers from the same IP over one hour, or repeated failures on the same user account from different countries. PCI-DSS 4.0 Req 10.2 mandates logging of access control failures and user authentication attempts. CWE-778 (Insufficient Logging) and OWASP A09 (Security Logging and Monitoring Failures) both target exactly this gap. Client-side console.log calls are ephemeral and invisible to your backend — they don't count as audit logging.

Add structured server-side logging in every payment error catch block. Include enough context for pattern detection without logging PII or card data.

} catch (err) {
  if (err instanceof Stripe.errors.StripeCardError) {
    console.error(JSON.stringify({
      event: 'payment_failed',
      timestamp: new Date().toISOString(),
      error_code: err.code,
      decline_code: err.decline_code,
      payment_intent_id: paymentIntentId,
      amount_cents: amount,
      currency,
      user_id: session?.userId ?? 'anonymous',
      // Do NOT log: card number, expiry, CVC, full email, full name
    }))

    return NextResponse.json({ error: 'Payment declined.' }, { status: 402 })
  }
}

Also handle the payment_intent.payment_failed webhook event to capture declines that occur asynchronously. Ship these structured logs to your observability platform (Datadog, Grafana, CloudWatch) and set an alert when failure rate exceeds a threshold.