TL;DR

Implement a standardized logging mechanism for failed login attempts using a shared LoginFailureReason enum to improve observability without exposing sensitive information.

Guidance

• Introduce a LoginFailureReason StrEnum to standardize reason codes for failed login attempts, ensuring consistency across console and web login flows.
• Log normalized email and remote IP addresses for failed login requests, excluding sensitive fields like passwords, tokens, and verification codes.
• Ensure the logging mechanism is implemented for both console and web login entry points, using the same reason-code vocabulary.
• Review existing login failure handling code to integrate the new logging mechanism, focusing on invalid credentials, account state, lockouts, and invalid email-code verification scenarios.

Example

from enum import StrEnum

class LoginFailureReason(StrEnum):
    INVALID_CREDENTIALS = "invalid_credentials"
    ACCOUNT_LOCKED = "account_locked"
    INVALID_EMAIL_CODE = "invalid_email_code"
    # Add other reason codes as needed

# Example logging implementation
def log_login_failure(reason: LoginFailureReason, email: str, remote_ip: str):
    # Log the failure reason, email, and remote IP, excluding sensitive information
    print(f"Login failure: {reason} - {email} - {remote_ip}")

Notes

This implementation assumes that the LoginFailureReason enum and logging mechanism will be integrated into the existing login failure handling code. The example provided is a simplified illustration and may require modifications to fit the specific use case.

Recommendation

Apply workaround by implementing the standardized logging mechanism using the LoginFailureReason enum, as it improves observability and consistency across login flows without exposing sensitive information.