Extend SecurityLogFilter use cases by JWT and OPAQUE tokens

[hamidonos]

Situations

Currently the SecurityLogFilter is tailored to the Basic Auth use case which leads to undefined behavior when JWT or OPAQUE token exceptions occur in the security filter chain.

Should 401 Unauthorized really print a WRONG_USAGE ?

data=
{
  "afterSessionClosed" : true,
  "basicAuthUser" : "error.unsupported-format",
  "clientIp" : "127.0.0.1",
  "httpHeaders" : {
    "accept" : "*/*",
    "accept-encoding" : "gzip, deflate, br",
    "authorization" : "***length:35",
    "connection" : "keep-alive",
    "cookie" : "JSESSIONID=DB89B0F08958D4B96DC74F679F1870D1",
    "host" : "localhost:8443",
    "postman-token" : "068d78bb-eaef-4671-898f-df86816bb3d3",
    "user-agent" : "PostmanRuntime/7.42.0"
  },
  "message" : "401 UNAUTHORIZED",
  "method" : "GET",
  "requestURI" : "/api/project/test/false-positives",
  "sessionId" : "DB89B0F08958D4B96DC74F679F1870D1",
  "type" : "WRONG_USAGE"
}
, message=401 UNAUTHORIZED

Wanted

JWT and OPAQUE should be supported by the SecurityLogFilter

Solution

• Expand the SecurityLogFilter