Skip to content

Add logging to /login failure #4688

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 6 commits into from
Jul 8, 2025
Merged

Add logging to /login failure #4688

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
39120cf
Add logging when user fails to verify password
erikjohnston Jun 16, 2025
485a577
Seperate out password mismatch vs failure
erikjohnston Jun 16, 2025
048acdb
Record password mismatch separately from errors
erikjohnston Jun 16, 2025
6f167a8
Review comments
erikjohnston Jun 20, 2025
612a15e
Rename PasswordVerificationFailed to PasswordMismatch
erikjohnston Jun 20, 2025
35a8d6c
clippy
erikjohnston Jun 20, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 9 additions & 1 deletion crates/data-model/src/users.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@
// SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-Element-Commercial
// Please see LICENSE files in the repository root for full details.

use std::net::IpAddr;
use std::{fmt::Display, net::IpAddr};

use chrono::{DateTime, Utc};
use rand::Rng;
Expand Down Expand Up @@ -47,6 +47,14 @@ impl User {
}
}

impl Display for User {
Copy link
Member

@sandhose sandhose Jun 19, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't like the idea of adding a display implementation for things in datamodel, unless the whole thing has an obvious string representation

Copy link
Member Author

@erikjohnston erikjohnston Jun 20, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Mmm, have removed for now. Although I do suspect we'll run into this later where we want to ergonomically log the user, so not sure what the best plan there is

fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
// Format the user as their username, this is useful for logging and
// debugging.
self.username.fmt(f)
}
}

#[derive(Debug, Clone, PartialEq, Eq, Serialize)]
pub struct Password {
pub id: Ulid,
Expand Down
8 changes: 5 additions & 3 deletions crates/handlers/src/admin/v1/users/set_password.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -145,7 +145,7 @@ mod tests {
use zeroize::Zeroizing;

use crate::{
passwords::PasswordManager,
passwords::{PasswordManager, PasswordVerificationResult},
test_utils::{RequestBuilderExt, ResponseExt, TestState, setup},
};

Expand Down Expand Up @@ -185,7 +185,7 @@ mod tests {
let mut repo = state.repository().await.unwrap();
let user_password = repo.user_password().active(&user).await.unwrap().unwrap();
let password = Zeroizing::new(String::from("this is a good enough password"));
state
let res = state
.password_manager
.verify(
user_password.version,
Expand All @@ -194,6 +194,7 @@ mod tests {
)
.await
.unwrap();
assert_eq!(res, PasswordVerificationResult::Success(()));
}

#[sqlx::test(migrator = "mas_storage_pg::MIGRATOR")]
Expand Down Expand Up @@ -244,7 +245,7 @@ mod tests {
let mut repo = state.repository().await.unwrap();
let user_password = repo.user_password().active(&user).await.unwrap().unwrap();
let password = Zeroizing::new("password".to_owned());
state
let res = state
.password_manager
.verify(
user_password.version,
Expand All @@ -253,6 +254,7 @@ mod tests {
)
.await
.unwrap();
assert_eq!(res, PasswordVerificationResult::Success(()));
}

#[sqlx::test(migrator = "mas_storage_pg::MIGRATOR")]
Expand Down
49 changes: 30 additions & 19 deletions crates/handlers/src/compat/login.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,7 +32,8 @@ use zeroize::Zeroizing;
use super::{MatrixError, MatrixJsonBody};
use crate::{
BoundActivityTracker, Limiter, METER, RequesterFingerprint, impl_from_error_for_route,
passwords::PasswordManager, rate_limit::PasswordCheckLimitedError,
passwords::{PasswordManager, PasswordVerificationResult},
rate_limit::PasswordCheckLimitedError,
};

static LOGIN_COUNTER: LazyLock<Counter<u64>> = LazyLock::new(|| {
Expand Down Expand Up @@ -193,7 +194,7 @@ pub enum RouteError {
NoPassword,

#[error("password verification failed")]
PasswordVerificationFailed(#[source] anyhow::Error),
PasswordVerificationFailed,
Copy link
Member

@sandhose sandhose Jun 19, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

To be consistent with the rest, split this into PasswordMismatch and PasswordVerificationFailed(#[source] anyhow::Error), and mark the second as an internal server error like we do for ProvisionDeviceFailed

Copy link
Member Author

@erikjohnston erikjohnston Jun 20, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Have renamed. Errors raised during verification are currently going to InternalError, is it helpful to split that up into a separate variant? I wouldn't have thought so as they're unexpected internal errors at that point.


#[error("request rate limited")]
RateLimited(#[from] PasswordCheckLimitedError),
Expand All @@ -210,6 +211,12 @@ pub enum RouteError {

impl_from_error_for_route!(mas_storage::RepositoryError);

impl From<anyhow::Error> for RouteError {
fn from(err: anyhow::Error) -> Self {
Self::Internal(err.into())
}
}

impl IntoResponse for RouteError {
fn into_response(self) -> axum::response::Response {
let sentry_event_id =
Expand Down Expand Up @@ -241,7 +248,7 @@ impl IntoResponse for RouteError {
error: "Missing property 'identifier",
status: StatusCode::BAD_REQUEST,
},
Self::UserNotFound | Self::NoPassword | Self::PasswordVerificationFailed(_) => {
Self::UserNotFound | Self::NoPassword | Self::PasswordVerificationFailed => {
MatrixError {
errcode: "M_FORBIDDEN",
error: "Invalid username/password",
Expand Down Expand Up @@ -576,28 +583,32 @@ async fn user_password_login(
// Verify the password
let password = Zeroizing::new(password);

let new_password_hash = password_manager
match password_manager
.verify_and_upgrade(
&mut rng,
user_password.version,
password,
user_password.hashed_password.clone(),
)
.await
.map_err(RouteError::PasswordVerificationFailed)?;

if let Some((version, hashed_password)) = new_password_hash {
// Save the upgraded password if needed
repo.user_password()
.add(
&mut rng,
clock,
&user,
version,
hashed_password,
Some(&user_password),
)
.await?;
.await?
{
PasswordVerificationResult::Success(Some((version, hashed_password))) => {
// Save the upgraded password if needed
repo.user_password()
.add(
&mut rng,
clock,
&user,
version,
hashed_password,
Some(&user_password),
)
.await?;
}
PasswordVerificationResult::Success(None) => {}
PasswordVerificationResult::Failure => {
return Err(RouteError::PasswordVerificationFailed);
}
}

// We're about to create a device, let's explicitly acquire a lock, so that
Expand Down
Loading
Loading