Insufficient Logging in Django with Bearer Tokens

Insufficient logging is a security risk where requests, authentication events, and authorization decisions are not recorded with enough detail to investigate incidents. When Bearer Tokens are used for authentication in Django, the combination can amplify detection and forensics challenges. Without structured logs that capture token usage, an attacker’s activity may leave little evidence, and defenders cannot reliably trace abuse back to a specific token or requester.

In Django, Bearer Tokens are typically passed in the Authorization header as Authorization: Bearer <token>. If logging does not explicitly extract and record the token (or a token identifier), logs may include only the endpoint path, timestamps, and outcome (e.g., 200 or 403). This omission hides critical context such as which token was used, whether it was valid, and whether it was reused across users or IPs. For example, a log line like [INFO] GET /api/data 200 provides no signal for detecting token leakage, replay, or privilege escalation.

The vulnerability surfaces further when token validation is handled in middleware or views without ensuring each validation step is logged. If a token is malformed or revoked but the application silently rejects the request with a generic 401/403 and logs no token metadata, an attacker can probe endpoints without leaving an actionable trail. Additionally, if logs record the full Authorization header in plaintext without redaction, they risk exposing credentials in log stores, creating a secondary exposure problem. Compounded, insufficient logging can obscure indicators of compromise such as abnormal token usage patterns (e.g., many requests from different IPs with the same token), making it harder to detect automated attacks or token sharing across systems.

From an OWASP API Top 10 perspective, insufficient logging and monitoring intersect with Broken Object Level Authorization (BOLA) and Security Misconfiguration. Without logs that include token identifiers, request context, and response status, post-incident analysis relies on guesswork. Real-world attack patterns such as token replay, credential stuffing, or lateral movement via compromised tokens become difficult to correlate and attribute. Logging should therefore capture enough pseudonymous context to support forensic timelines while avoiding unsafe storage of raw secrets.

Remediation focuses on ensuring that authentication events and authorization decisions are recorded with token context, while avoiding unsafe exposure of raw credentials. In Django, implement structured logging in middleware or dedicated authentication handlers to capture token metadata and request outcomes. Below are concrete code examples that demonstrate secure logging practices for Bearer Token authentication.

First, configure Django logging to include request and token context without persisting the full token. Use a middleware that extracts the token identifier (e.g., a token ID portion or a hashed representation) and logs key events:

import logging
import hashlib

from django.utils.deprecation import MiddlewareMixin

logger = logging.getLogger(__name__)
class BearerTokenLoggingMiddleware(MiddlewareMixin):
    def process_request(self, request):
        auth_header = request.headers.get('Authorization', '')
        if auth_header.startswith('Bearer '):
            token = auth_header.split(' ', 1)[1]
            # Use a stable, non-reversible representation for logging
            token_fingerprint = hashlib.sha256(token.encode('utf-8')).hexdigest()
            request.token_fingerprint = token_fingerprint
            logger.info('AuthCheck', extra={
                'path': request.path,
                'method': request.method,
                'token_fingerprint': token_fingerprint,
                'event': 'token_seen',
            })
        else:
            request.token_fingerprint = None

    def process_response(self, request, response):
        if hasattr(request, 'token_fingerprint'):
            logger.info('AuthResult', extra={
                'path': request.path,
                'method': request.method,
                'token_fingerprint': getattr(request, 'token_fingerprint'),
                'status': response.status_code,
                'event': 'auth_result',
            })
        return response

Second, in views or service layers where token validation occurs, log authorization decisions with token context. For instance, when checking ownership or scope, include the token fingerprint and the outcome:

from django.http import JsonResponse
from django.views import View
class DataView(View):
    def get(self, request):
        auth_header = request.headers.get('Authorization', '')
        if not auth_header.startswith('Bearer '):
            logger.warning('MissingOrMalformedToken', extra={
                'path': request.path,
                'token_fingerprint': getattr(request, 'token_fingerprint', 'none'),
                'event': 'missing_token',
            })
            return JsonResponse({'error': 'Unauthorized'}, status=401)

        # Assume validate_token returns {'user_id': ..., 'scopes': ..., 'token_id': ...} or None
        token_payload = validate_token(auth_header.split(' ', 1)[1])
        if not token_payload:
            logger.warning('InvalidToken', extra={
                'path': request.path,
                'token_fingerprint': getattr(request, 'token_fingerprint'),
                'event': 'invalid_token',
            })
            return JsonResponse({'error': 'Forbidden'}, status=403)

        # Example: BOLA check — ensure token user_id matches requested resource
        resource_id = request.GET.get('resource_id')
        if not self.user_owns_resource(token_payload['user_id'], resource_id):
            logger.warning('BOLAAttempt', extra={
                'path': request.path,
                'token_fingerprint': getattr(request, 'token_fingerprint'),
                'user_id': token_payload['user_id'],
                'requested_resource': resource_id,
                'event': 'authorization_failure',
            })
            return JsonResponse({'error': 'Forbidden'}, status=403)

        logger.info('AuthorizedAccess', extra={
            'path': request.path,
            'token_fingerprint': getattr(request, 'token_fingerprint'),
            'user_id': token_payload['user_id'],
            'event': 'success',
        })
        return JsonResponse({'data': 'sensitive_resource'})

    def user_owns_resource(self, user_id, resource_id):
        # Placeholder for actual ownership logic
        return True

These patterns ensure logs include a token fingerprint (a deterministic hash) rather than the raw token, reducing secret exposure while enabling correlation across requests. They also record outcomes (success, invalid token, BOLA attempt) to support detection of abuse patterns. In production, pair these logs with centralized log management and retention policies aligned with compliance requirements.