nhcarrigan/library
9
0
Fork 0
generated from nhcarrigan/template
Code Issues Pull Requests 54 Actions Releases 3 Activity

fix: omit audit log entries for 401s on /api/auth/me

Browse Source 
Token expiry probes against /api/auth/me are expected behaviour during
the refresh flow and should not generate unauthorized access audit events.
This commit is contained in:
Hikari
2026-02-23 20:09:36 -08:00
committed by Naomi Carrigan
parent fa4c1d8958
commit b81b77ac2f
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
api/src/app/app.ts
+2 -2
View File
@@ -22,8 +22,8 @@ export async function app(fastify: FastifyInstance, opts: AppOptions) {
}); });
} }
// Log unauthorized access attempts // Log unauthorized access attempts (exclude /api/auth/me as 401s there are expected during token refresh)
if (error.statusCode === 401 || error.statusCode === 403) { if ((error.statusCode === 401 || error.statusCode === 403) && request.url !== '/api/auth/me') {
await AuditService.log({ await AuditService.log({
action: AuditAction.unauthorizedAccess, action: AuditAction.unauthorizedAccess,
category: AuditCategory.security, category: AuditCategory.security,