Failed authentications should be logged to log.Error instead of log.Info

[itzonban]

Feature Description

Hi,

it would be great if failed authentications would be logged to ERROR level instead of INFO.

routers/web/auth/auth.go:231:SignInPost() [I] Failed authentication attempt for username from 1.1.1.1:44774: user does not exist [uid: 0, name: username]

It is in fact an error and the INFO level output can still be a bit much in production, therefore it would be preferable to be able to lower the level to "warn" and still catch the failed logins for fail2ban etc.

If I see it correctly the change need to be done in routers/web/auth/auth.go in lines 227-252.
What do you think?

Best regards
Daniel

Screenshots

No response

[yp05327]

Can you send a PR?

[itzonban]

I just did

[delvh]

It is in fact an error

Precisely not.
An error is something Gitea did itself that failed.
But Gitea did not do anything here, other than handle the request (successfully!).
So, yes, I can agree with a change to WARNING, but the ERROR level seems overinflated.
Especially on larger instances, it will pollute your log with actions you cannot do anything against.

[itzonban]

It is in fact an error

Precisely not. An error is something Gitea did itself that failed. But Gitea did not do anything here, other than handle the request (successfully!). So, yes, I can agree with a change to WARNING, but the ERROR level seems overinflated. Especially on larger instances, it will pollute your log with actions you cannot do anything against.

Ok, I see your point in how you define "error" in this case.
I will create another PR for WARNING tomorrow... if you are still fine with it.. shall I just close the old PR or can you delete it?