What are your recommendations about sending authentication failures to Sentry?

[craigmcc]

I am not talking about problems with Sentry itself.

I am talking about when a user tries to log in to my system, and the username/password match (or whatever depending on your auth implementation) fails. For simplicity sake, let's assume we are talking about self username password authentication. Should that be reported in a Sentry event?

I can think of at least three alternatives:

• Send a failure notice to Sentry, including both the failed username and password.
• Send a failure notice to Sentry, including maybe only the proposed username.
• Do not send a failure notice to Sentry (and maybe deal with it locally).

Either of the first two alternatives seems like a risk of unwarranted sharing of PII (think about a user that gets their username right but has an off-by-one character mis-type in the password). In the second case, it can potentially be determined that a particular username is under attack.

But what happens if Sentry itself is breached?

I am inclined towards the third alternative, but that puts the onus of protecting information back on me, of course.

What does Sentry recommend your users do in this kind of scenario?

[getsantry]

Assigning to @getsentry/support for routing ⏲️

[getsantry]

Routing to @getsentry/product-owners-settings-auth for triage ⏲️

[leedongwei]

Hello @craigmcc

Sentry is generally meant for bugs in your code, and a user putting in a wrong password is not a bug.

If you're concerned about regressions on your authentication API, then we have an alerting feature that can ping you when the throughput or error count from the API becomes anomalous. You would not need to send user information for this use case.

If you're concerned about attacks on a specific user, then you need to consider the actions you'd want to take and then pick your tooling from there.

If you have to send user information to Sentry, then user_id should be more than sufficient for your purposes.