Insufficient Logging in Chi with Cockroachdb

Insufficient logging in a Chi application using CockroachDB can leave critical security events undocumented, reducing the ability to detect, investigate, or respond to incidents. Chi is a lightweight, idiomatic routing library for Clojure web applications, and when requests interact with CockroachDB— a cloud-native, PostgreSQL-compatible distributed database— the absence of structured, contextual logs creates blind spots in the security posture.

Without explicit logging of request identifiers, SQL operation outcomes, and authentication context, failed or suspicious queries may go unnoticed. For example, if an attacker probes for non-existent user IDs or attempts SQL injection, these behaviors would not be recorded with sufficient detail to support incident analysis. middleBrick scans for such gaps as part of its 12 parallel security checks, including Property Authorization and Input Validation, and flags missing observability as a finding that can contribute to a higher overall risk score (e.g., a grade in the D–F range).

In a Chi service, each HTTP request typically routes to handlers that open a database connection, execute queries, and return responses. If these handlers do not log key events— such as connection acquisition, query execution results, error details, or transaction boundaries— there is no reliable audit trail. This becomes particularly risky when combined with CockroachDB’s distributed nature, where operations may span multiple nodes and retries are common. Without logs that capture request-scoped metadata and SQL statement outcomes, distinguishing benign failures from malicious activity becomes difficult.

middleBrick’s checks include BOLA/IDOR and Authentication testing, which can surface scenarios where insufficient logging prevents detection of unauthorized access across tenant boundaries. For instance, if a handler logs only successful queries and omits failed authorization checks or input validation errors, an attacker may iterate over identifiers without triggering alerts. The scanner’s LLM/AI Security module also examines whether runtime outputs expose sensitive data, which can be more likely when error details are inconsistently logged or omitted.

To align with compliance mappings such as OWASP API Top 10 and SOC2, logging must be structured and include timestamps, request IDs, user context (when available), operation type, and outcome status. middleBrick’s dashboard and reports highlight these gaps and provide prioritized findings with remediation guidance, helping teams improve observability without relying on speculative assumptions about what occurred during an incident.

Remediation focuses on introducing structured logging at key points in Chi request handling and database interaction. Logs should be emitted using a dedicated logging library (e.g., taoensso/timbre) and should include correlation IDs to trace a request across services and database nodes. Avoid logging sensitive data such as passwords or personal information, and ensure that log levels are appropriately set (e.g., :info for normal operations, :warn for validation failures, :error for database or authorization issues).

Below are concrete Clojure code examples showing how to instrument a Chi route that interacts with CockroachDB. These snippets illustrate consistent logging patterns for connection acquisition, successful queries, transaction handling, and error conditions.

(ns myapp.handler
  (:require [compojure.core :refer [GET POST]]
            [cheshire.core :as json]
            [next.jdbc :as jdbc]
            [taoensso.timbre :as log]
            [ring.util.response :as resp]))

(def db
  {:dbtype "postgresql"
   :dbname "mydb"
   :host "localhost"
   :port 26257
   :user "myuser"
   :password "mypassword"
   :connection-uri "postgresql://myuser:mypassword@localhost:26257/mydb?sslmode=require"})

(defn log-db-operation [request-id op status details]
  (log/info :event :db-operation
            :request-id request-id
            :operation op
            :status status
            :details details))

(defn handle-error [request-id op err]
  (log/error :event :db-error
             :request-id request-id
             :operation op
             :error (ex-message err)
             :class (class err)))

(defn get-user-handler [request]
  (let [request-id (:request-id (:headers request))
        user-id (-> request :params :user-id)]
    (try
      (let [result (jdbc/execute! db ["SELECT id, email FROM users WHERE id = ?" user-id])]
        (log-db-operation request-id "SELECT users WHERE id" :success {:rows (count result)})
        (resp/json-response (first result)))
      (catch Exception e
        (handle-error request-id "SELECT users" e)
        (resp/internal-server-error {:error "internal"})))))

(defn create-order-handler [request]
  (let [request-id (:request-id (:headers request))
        body (-> request :body :content)
        user-id (:user-id body)]
    (try
      (jdbc/with-transaction [conn db]
        (jdbc/execute! conn ["INSERT INTO orders (user_id, total) VALUES (?, ?)" user-id (:total body)])
        (log-db-operation request-id "INSERT orders" :success {:user-id user-id})
        (jdbc/execute-one! conn ["SELECT * FROM orders WHERE user_id = ?" user-id])
        (log-db-operation request-id "SELECT orders by user" :success {})
        (resp/json-response {:status :created}))
      (catch Exception e
        (handle-error request-id "transaction" e)
        (resp/internal-server-error {:error "internal"})))))

In these examples, each database interaction is paired with a log entry that includes a request identifier, operation description, status, and relevant non-sensitive details. Using with-transaction ensures that transaction boundaries are explicit, and errors are captured with context. This approach supports middleBrick’s checks for Property Authorization and Input Validation by making it easier to correlate failed operations with specific requests and users. Continuous monitoring with the Pro plan can further ensure that logging practices remain consistent across deployments, and the GitHub Action can fail builds if required log fields are missing from the source code.

For teams using the MCP Server in AI coding assistants, these patterns can be suggested or validated directly within the development environment, helping maintain logging standards as code evolves. The Dashboard can track changes to logging configurations over time, supporting compliance reporting and change management.