Is it good practice to use a table in Postgres as an audit log for login events? The database has other tables like users, posts etc. If the backend receives a failed login, it would insert into the audit table the timestamp, username, action type (in this case failed).

  • Safe from what? – schroeder Dec 4 at 13:26
  • This question is missing any context at all to be able to answer. Are you asking about Postgres, specifically? Are you asking about storing login audit logs on a database? What other options do you have to store the logs? What else is in the database? Who has access? Where is the database if not also in the backend? And so many other questions... – schroeder Dec 4 at 13:29
  • It's not safe to log failed passwords since typos will show up in there, and it will be easy to figure out what the real password is. Usernames are typically not required to be secret, but you also will end up with people accidentally putting either their password as the username or their username concatenated with their password if they failed to hit tab or tab didn't move to the next field. – user Dec 4 at 13:31
  • Yes I'm using Postgres and I want to store login audit logs. The database contains other tables that the app needs to function like users, posts. I don't want to store passwords, just timestamp, action type, username. – civ15 Dec 4 at 13:35
  • 1
    Maybe relocate this one to DBA.SE – Gaius Dec 4 at 13:47

Browse other questions tagged or ask your own question.