Summary
When an auth token fails validation on a protected route, the 401 response is returned to the client but no structured log is emitted. A warn-level log at the validation failure point helps distinguish expired tokens from malformed ones without exposing the token value.
Scope
- identify where auth token validation occurs for protected routes
- add a warn-level structured log on validation failure
- include the failure reason, route path, and request ID but not the token value
Acceptance Criteria
- a token validation failure emits a warn-level log with reason, route, and request ID
- the token value is not present in the log
- the client 401 response is unchanged
Contributor coordination: if you pick this up, reach out in Telegram for updates or clarification: https://t.me/accesslayerorg
Summary
When an auth token fails validation on a protected route, the 401 response is returned to the client but no structured log is emitted. A warn-level log at the validation failure point helps distinguish expired tokens from malformed ones without exposing the token value.
Scope
Acceptance Criteria
Contributor coordination: if you pick this up, reach out in Telegram for updates or clarification: https://t.me/accesslayerorg