Security logging and audit trails for auth events

Without audit logs for authentication events, you cannot detect an ongoing attack, reconstruct a breach timeline, or satisfy incident response obligations. CWE-778 (Insufficient Logging) and OWASP A09 (Security Logging and Monitoring Failures) document that undetected breaches are the norm, not the exception, for applications with no auth logging. NIST 800-53 AU-2 requires auditable events to include logon attempts, account changes, and authorization failures. A password reset initiated by an attacker, account lockouts triggered by credential stuffing, or privilege escalation — none of these are visible without structured, persistent auth event logging.

Log auth events to a persistent database table with timestamp, event type, user ID, and IP address:

// lib/audit-log.ts
type AuditEvent =
  | 'auth.login.success' | 'auth.login.failure'
  | 'auth.logout' | 'auth.account_locked'
  | 'auth.password_reset.requested' | 'authz.forbidden'

export async function logAuditEvent(
  event: AuditEvent,
  ctx: { userId?: string; email?: string; ip: string }
) {
  await db.auditLog.create({
    data: { event, userId: ctx.userId ?? null, ipAddress: ctx.ip, createdAt: new Date() },
  })
}

// In login handler:
await logAuditEvent('auth.login.failure', { email, ip })

Do not rely on console.log — container restarts discard stdout. Log to a database table or a structured logging service (Axiom, Datadog) with at least 90-day retention.