OWASP A09:2021 is Security Logging and Monitoring Failures. What should a backend log for security, what must it never log, and why does monitoring matter?

Log security events with enough detail to investigate them later.

Events to log:

• Successful and failed logins.
• MFA changes and password changes.
• Authorization failures, where a user tries something they aren't allowed to do.
• Validation failures that look like attacks.
• Admin actions.
• Refresh token reuse.
• Rate-limit triggers.

For each event, include the timestamp, user or client id, source IP, request id and outcome. Use a structured format, such as JSON. Send logs to central storage that the app itself can't change, so an attacker who takes over the app can't erase them.

Never log:

• Passwords or session ids.
• Access tokens, refresh tokens or API keys.
• Full card numbers.
• Personal data you don't need.

Remove or encode newlines in user input before you log it. This prevents log injection, where an attacker writes fake log entries.

Logs without monitoring only help after an attack is over. Set alerts on patterns, such as a spike in failed logins or repeated 403 responses on other users' resources. Alerts shorten how long an attacker stays unnoticed.