Insufficient Logging with Jwt Tokens

Insufficient logging in JWT token systems creates blind spots that attackers exploit to maintain persistent access. When JWT tokens are compromised but logging is inadequate, security teams cannot detect token replay attacks, token manipulation attempts, or unauthorized token generation.

The most common manifestation occurs when applications fail to log token validation failures. Consider this vulnerable pattern:

function verifyJWT(token) {
  try {
    const decoded = jwt.verify(token, process.env.JWT_SECRET);
    return decoded;
  } catch (err) {
    // ERROR: No logging of failed verification attempts
    return null;
  }
}

Attackers can repeatedly submit malformed tokens without triggering any alerts. A brute-force attack attempting to guess token secrets or manipulate token claims goes completely undetected.

Another critical gap appears in token rotation scenarios. When applications implement refresh token mechanisms but don't log refresh token usage:

app.post('/refresh', (req, res) => {
  const { refreshToken } = req.body;
  
  // ERROR: No logging of refresh token usage
  const user = findUserByRefreshToken(refreshToken);
  if (!user) {
    return res.status(401).json({ error: 'Invalid refresh token' });
  }
  
  const newToken = generateJWT(user);
  res.json({ token: newToken });
});

Without logging refresh token requests, attackers can harvest valid refresh tokens through XSS or database breaches and generate unlimited new access tokens without detection.

Token revocation logging failures represent another critical vulnerability. When users log out or administrators revoke tokens, applications often don't log these events:

// ERROR: No logging of token revocation
function logout(req, res) {
  const token = extractTokenFromHeader(req);
  blacklistToken(token);
  res.json({ message: 'Logged out successfully' });
}

This allows attackers who have already stolen tokens to continue using them indefinitely, as there's no record of the revocation attempt.

Detecting insufficient logging in JWT systems requires examining both code patterns and runtime behavior. Code analysis should look for these anti-patterns:

// Red flags in code review
if (err instanceof jwt.JsonWebTokenError || err instanceof jwt.TokenExpiredError) {
  // ERROR: Silent failure, no logging
  return res.status(401).json({ error: 'Invalid token' });
}

// Missing audit trail for token operations
function generateToken(user) {
  const token = jwt.sign({ sub: user.id }, secret, { expiresIn: '1h' });
  // ERROR: No logging of token generation with user context
  return token;
}

// No correlation between user identity and token activity
app.use((req, res, next) => {
  const token = extractToken(req);
  if (token) {
    // ERROR: Token validated but not logged with request context
    req.user = verifyJWT(token);
  }
  next();
});

Runtime detection focuses on monitoring authentication endpoints for suspicious patterns. A JWT system with insufficient logging shows these characteristics:

middleBrick's JWT-specific scanning detects these logging deficiencies by analyzing authentication endpoints for proper audit trail implementation. The scanner checks whether failed token verifications are logged with sufficient context (timestamp, IP, user agent, attempted claims) and whether token lifecycle events (generation, rotation, revocation) create appropriate audit records.

Automated scanning with middleBrick reveals logging gaps that manual review might miss. The tool tests authentication endpoints with malformed tokens, expired tokens, and tokens with manipulated claims, then verifies whether these attempts generate appropriate security logs.

Remediating insufficient logging in JWT systems requires implementing comprehensive audit trails for all token operations. Here's a complete logging implementation:

const logger = require('./security-logger');

// Enhanced token verification with comprehensive logging
function verifyJWTWithLogging(token, req) {
  try {
    const decoded = jwt.verify(token, process.env.JWT_SECRET);
    
    // Log successful verification with full context
    logger.audit('JWT_VERIFY_SUCCESS', {
      userId: decoded.sub,
      tokenId: decoded.jti,
      ip: req.ip,
      userAgent: req.get('User-Agent'),
      endpoint: req.originalUrl,
      method: req.method
    });
    
    return decoded;
  } catch (err) {
    // Detailed logging of verification failures
    logger.security('JWT_VERIFY_FAILURE', {
      errorType: err.name,
      errorMessage: err.message,
      ip: req.ip,
      userAgent: req.get('User-Agent'),
      endpoint: req.originalUrl,
      method: req.method,
      token: token.substring(0, 20) + '...' // Mask token
    });
    
    throw err;
  }
}

// Enhanced token generation with audit logging
function generateAuditedToken(user, req) {
  const token = jwt.sign(
    { 
      sub: user.id,
      jti: uuidv4(),
      iat: Math.floor(Date.now() / 1000)
    },
    process.env.JWT_SECRET,
    { expiresIn: '1h' }
  );
  
  // Log token generation with user context
  logger.audit('JWT_GENERATE', {
    userId: user.id,
    tokenId: uuidv4(),
    issuedTo: user.email,
    ip: req.ip,
    userAgent: req.get('User-Agent'),
    purpose: 'authentication'
  });
  
  return token;
}

// Enhanced refresh token handling
app.post('/refresh', (req, res) => {
  const { refreshToken } = req.body;
  
  try {
    const decoded = jwt.verify(refreshToken, process.env.REFRESH_SECRET);
    
    // Log refresh token usage
    logger.audit('JWT_REFRESH', {
      userId: decoded.sub,
      ip: req.ip,
      userAgent: req.get('User-Agent'),
      previousToken: decoded.jti
    });
    
    const newToken = generateAuditedToken(decoded, req);
    res.json({ token: newToken });
  } catch (err) {
    logger.security('JWT_REFRESH_FAILURE', {
      error: err.message,
      ip: req.ip,
      token: refreshToken.substring(0, 20) + '...'
    });
    res.status(401).json({ error: 'Invalid refresh token' });
  }
});

// Enhanced logout with token revocation logging
function enhancedLogout(req, res) {
  const token = extractTokenFromHeader(req);
  
  try {
    const decoded = jwt.verify(token, process.env.JWT_SECRET);
    
    // Revoke token
    blacklistToken(token);
    
    // Log revocation with full context
    logger.audit('JWT_REVOKE', {
      userId: decoded.sub,
      tokenId: decoded.jti,
      ip: req.ip,
      userAgent: req.get('User-Agent'),
      reason: 'user_logout'
    });
    
    res.json({ message: 'Logged out successfully' });
  } catch (err) {
    logger.security('JWT_REVOKE_FAILURE', {
      error: err.message,
      ip: req.ip,
      token: token.substring(0, 20) + '...'
    });
    res.status(401).json({ error: 'Invalid token' });
  }
}

Key logging requirements for JWT systems:

• Log all token verification attempts (success and failure) with user context, IP, and endpoint
• Audit token generation events with issuing user and purpose
• Track refresh token usage to detect token theft
• Log token revocation attempts with reason codes
• Include correlation IDs to link related authentication events
• Set up alerts for suspicious patterns (repeated failures, unusual refresh rates, geographic anomalies)

Integration with middleBrick's continuous monitoring helps validate that logging implementations meet security standards. The scanner tests whether authentication endpoints produce appropriate audit logs when subjected to various attack scenarios.