Insufficient Logging in Gin with Bearer Tokens

Insufficient Logging in a Gin API that uses Bearer Tokens creates a detection gap: authentication events and authorization decisions are not recorded in enough detail to reconstruct an incident. Without structured logs that capture the token identifier, the raw token (never logged), the subject or scope associated with the token, the HTTP method, path, status code, and key security decisions, an incident response relies on incomplete or missing evidence. This becomes critical when tokens are issued with broad privileges or when a compromised token is used to access sensitive endpoints.

In Gin, developers often rely on default access logs or skip logging for authenticated routes under the assumption that the framework or middleware handles security. Bearer Tokens are typically passed in the Authorization header. If middleware does not extract and log a non-reversible representation of the token (such as a token ID or subject claim) along with the request context, an attacker can exploit weak or missing rate limiting, IDOR, or privilege escalation paths without leaving actionable traces. For example, a token issued to a low-privilege account that elevates via BOLA may not be logged with sufficient context to differentiate it from legitimate elevated usage. Similarly, missing logs for failed authentication or authorization responses means brute-force or token-replay attempts are invisible.

The interaction with middleware is key. A Gin middleware stack that validates Bearer Tokens should log before and after validation outcomes, including claims extracted from the token, while ensuring no raw tokens are written to logs. Inadequate correlation IDs or missing structured formats (e.g., JSON) further reduce the ability to trace a sequence of calls across services. Without logs that include the token’s scope, issuer, audience, and expiration, it is difficult to detect anomalies such as token reuse across users, usage outside expected time windows, or access to high-risk endpoints like administrative functions.

Real-world attack patterns such as IDOR via insufficient ownership checks, or BFLA through missing authorization on administrative endpoints, are harder to detect if logs do not record the decision outcome and the identity derived from the Bearer Token. For instance, a request to /users/{id} with a valid Bearer Token should log whether the token’s subject matches the requested ID and whether authorization succeeded or failed. Missing these details means even if an OpenAPI spec analysis flags a missing security requirement, runtime detection lacks coverage.

To address this securely within Gin’s ecosystem, teams should implement structured logging that captures essential security context without exposing sensitive material. This complements runtime security checks such as those provided by scanning platforms that test for Insufficient Logging as part of the 12 parallel security checks. Logging should be designed to support incident investigation and compliance mapping to frameworks such as OWASP API Top 10 and PCI-DSS, while avoiding any storage of raw Bearer Tokens.

Remediation centers on structured, token-aware logging within Gin handlers and middleware. You should log enough context to identify requests and authorization outcomes while ensuring tokens themselves are never recorded. Below is a complete, syntactically correct example that demonstrates secure logging with Bearer Tokens in Gin.

package main

import (
	"fmt"
	"net/http"
	"time"

	"github.com/gin-gonic/gin"
	"github.com/golang-jwt/jwt/v5"
)

// tokenClaims defines the expected payload for the example Bearer Token.
type tokenClaims struct {
	Subject string `json:"sub"`
	Scope   string `json:"scope"`
	Issuer  string `json:"iss"`
	jwt.RegisteredClaims
}

// authMiddleware validates Bearer Tokens and enriches the context with claims.
func authMiddleware() gin.HandlerFunc {
	return func(c *gin.Context) {
		authHeader := c.GetHeader("Authorization")
		if authHeader == "" {
			c.JSON(http.StatusUnauthorized, gin.H{"error": "missing authorization header"})
			// Structured log: failed auth attempt with no token provided
			c.Set("log", gin.H{
				"timestamp":  time.Now().UTC().Format(time.RFC3339),
				"method":     c.Request.Method,
				"path":       c.Request.URL.Path,
				"status":     http.StatusUnauthorized,
				"auth_stage": "missing_token",
			})
			c.Abort()
			return
		}

		const bearerPrefix = "Bearer "
		if len(authHeader) < len(bearerPrefix) || authHeader[:len(bearerPrefix)] != bearerPrefix {
			c.JSON(http.StatusUnauthorized, gin.H{"error": "invalid authorization scheme"})
			c.Set("log", gin.H{
				"timestamp":  time.Now().UTC().Format(time.RFC3339),
				"method":     c.Request.Method,
				"path":       c.Request.URL.Path,
				"status":     http.StatusUnauthorized,
				"auth_stage": "invalid_scheme",
			})
			c.Abort()
			return
		}

		tokenString := authHeader[len(bearerPrefix):]
		// In production, use a proper keyfunc and validation; this is illustrative.
		token, err := jwt.ParseWithClaims(tokenString, &tokenClaims{}, func(token *jwt.Token) (interface{}, error) {
			// TODO: provide your key or public cert here
			return []byte("example-secret"), nil
		})

		if err != nil || !token.Valid {
			c.JSON(http.StatusUnauthorized, gin.H{"error": "invalid token"})
			c.Set("log", gin.H{
				"timestamp":   time.Now().UTC().Format(time.RFC3339),
				"method":       c.Request.Method,
				"path":         c.Request.URL.Path,
				"status":       http.StatusUnauthorized,
				"auth_stage":   "token_invalid",
				"token_subject": nil, // intentionally omitted for security
			})
			c.Abort()
			return
		}

		claims, ok := token.Claims.(*tokenClaims)
		if !ok {
			c.JSON(http.StatusUnauthorized, gin.H{"error": "invalid token claims"})
			c.Set("log", gin.H{
				"timestamp":  time.Now().UTC().Format(time.RFC3339),
				"method":     c.Request.Method,
				"path":       c.Request.URL.Path,
				"status":     http.StatusUnauthorized,
				"auth_stage": "claims_parse_failed",
			})
			c.Abort()
			return
		}

		// Store claims for downstream use and logging; never store the raw token.
		c.Set("claims", claims)
		c.Next()
	}
}

// loggingMiddleware emits structured logs after the request is processed.
func loggingMiddleware() gin.HandlerFunc {
	return func(c *gin.Context) {
		c.Next()
		claims, _ := c.Get("claims")
		logEntry := gin.H{
			"timestamp": time.Now().UTC().Format(time.RFC3339),
			"method":     c.Request.Method,
			"path":       c.Request.URL.Path,
			"status":     c.Writer.Status(),
		}
		if claims != nil {
			if c, ok := claims.(*tokenClaims); ok {
				logEntry["token_subject"] = c.Subject
				logEntry["token_scope"] = c.Scope
				logEntry["token_issuer"] = c.Issuer
			}
		} else {
			logEntry["auth_missing"] = true
		}
		// TODO: output logEntry to your structured logging backend (e.g., JSON to stdout)
		_ = logEntry
	}
}

func adminHandler(c *gin.Context) {
	claims, _ := c.Get("claims")
	if claims == nil {
		c.JSON(http.StatusUnauthorized, gin.H{"error": "unauthorized"})
		return
	}
	c.JSON(http.StatusOK, gin.H{"message": "admin access granted"})
}

func main() {
	r := gin.Default()
	r.Use(authMiddleware())
	r.Use(loggingMiddleware())
	r.GET("/admin", adminHandler)
	r.Run()
}

This example shows Bearer Token validation and structured logging that captures subject, scope, issuer, method, path, and status without writing raw tokens to logs. It aligns with remediation guidance for Insufficient Logging by ensuring traceable, non-repudiable records for each authenticated request.