Authentication events are logged for audit purposes

Without auth event logging, a brute-force campaign, credential stuffing run, or account takeover leaves no trace in your infrastructure. CWE-778 (Insufficient Logging) directly applies. OWASP A09 (Security Logging and Monitoring Failures) lists insufficient logging of authentication events as a primary failure mode. PCI-DSS Req-10.2.1 mandates logging of all individual user access events. ISO 27001:2022 A.8.15 requires audit trail maintenance for all authenticated actions. When an account is compromised and you have no logs, you cannot determine scope, timeline, or affected users — incident response becomes guesswork.

Log key auth events as structured JSON so they can be queried and alerted on — never log passwords or tokens:

// Structured auth event logging
console.log(JSON.stringify({
  event: 'auth.login.success',
  userId: user.id,
  ip: request.headers.get('x-forwarded-for') ?? 'unknown',
  userAgent: request.headers.get('user-agent'),
  timestamp: new Date().toISOString()
}))

// Failed login — log enough to detect brute force:
console.log(JSON.stringify({
  event: 'auth.login.failure',
  email,          // Not the password
  ip: request.headers.get('x-forwarded-for'),
  timestamp: new Date().toISOString()
}))

Ship these events to your log aggregation service (Datadog, Logtail, CloudWatch) and set an alert for N login failures per user within a sliding window. If using Clerk or Auth0, verify that their built-in event logs are being exported to your SIEM.