Objective

Improve the audit logging in the router. For each RESTful http request, we currently only log the URL of the request. We need to log the request body or response body if useful information (dataset properties, program runtime arguments, etc.) is included. 

RESTful endpoints that need to be logged with more information

All RESTful endpoints that needs to be logged with more information are in this table, click to expand.

Implementation

Currently, in SecurityAuthenticationHttpHandler, we already have each request audit logged. For each incoming request, we log the clientIP, the URL from HTTPRequest and the responseCode from HTTPResponse. We will still keep this as the default behavior for audit logging.

To log the request body, header name or response body, we annotate the RESTful endpoint methods with a new custom annotation AuditPolicy such as: 

/**
 * Annotates a RESTful endpoint method to indicate which content needs to be audit logged.
 */
@Retention(RetentionPolicy.RUNTIME)
@Target(ElementType.METHOD)
public @interface AuditPolicy {

  boolean requestBody() default false;

  boolean responseBody() default false;
  
  String [] headerParams() default {};
}

For example, for the deploy app REST call, we want to log several header names and the response body, so we annotate the method as:

/**
 * Annotate the method with the @AuditPolicy, with response body set to true, and set header names that need to be logged as an array.
 */
@POST
@Path("/apps")
@AuditPolicy(responseBody = true, headerNames = {ARCHIVE_NAME_HEADER, APP_CONFIG_HEADER})
public BodyConsumer deploy(HttpRequest request, HttpResponder responder, ...) throws Exception {
 ...
}

When the router starts up, we will walk through all methods in each handler class to find if the method has a @AuditPolicy annotation. If the method does not have this annotation, the default behavior is used(log the URL, response body, etc). If it is present, then we will log the additional information provided by this annotation.

How to walk through all handler classes

We will first start with all handler classes hard-coded in a list, will explore the Classpath library to dynamically get all the handler classes.

Releases

release 4.1.0