Log the activity of the users' sessions

[marien-probesys]

Problem

For security reasons, it's important to know who has logged into Bileto and when. This would help administrators to determine if accounts have been compromised.

Solution

Allow administrators to see the activity of the users' sessions.

Specifications

Related OWASP document: https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html#logging-sessions-life-cycle-monitoring-creation-usage-and-destruction-of-session-ids

Record the activity of the users' sessions in database

We should log several events related to the sessions:

• creation (aka login), either successful or failed - see https://symfony.com/doc/current/security.html#security-events
• deletion (aka logout) - see https://symfony.com/doc/current/security.html#security-events
• reset passwords
• changed passwords

The logs must include at least this information:

• the event timestamp
• the source IP address
• HTTP headers such as the User-Agent and Referer
• the user id
• the user email
• a hash of the session ID

We must create a new SessionLog entity to store these information. The HTTP headers can be stored in a JSON array.

The user id must be stored as a foreign key, set to null on cascade. We store the email address in addition to prevent an attacker to erase his traces.

Display the activity of the users' session

For now, only the administrators will be able to see the users' activity. They must have the "Manage users" (admin:manage:users) permission.

The activity must be displayed in a new block of the user page, under the "Authorizations" section.

The logs must be displayed by session (if any) and chronologically. This can be challenging so as a first step, they can be displayed chronologically only. The session hash must be highlighted then, with a .badge for instance.

Log rotation

The App\MessageHandler\CleanDataHandler must delete the SessionLog entities:

• after 1 month if the user relation is null (it means that the user has been deleted)
• after 1 year otherwise in order to not keep this data indefinitely

Estimated time

2 - 3 days