2

Currently I am saving LastLoginAt, LastActionAt, LastLogoutAt, and LastLoginFromIPAddress. I am not so sure about the value of logging/saving details of logouts and IP addresses, as I am not sure of what use they would actually be. What is the "best" practice here when it comes to saving info about user logins?

1 Answer 1

4

You didn't provide any specifics about your app, but you generally should log much more than you're currently storing. See this logging Cheat Sheet for more details.

Generally: if you only store info about "last" actions, you have very little to work with if you need to use any of that data at a later date.

Even for a "simple" web app I've found it extremely useful to store a full log of login/logout actions, with associated IP addresses and even the User-Agent string (if it's a web app). You should probably also log invalid login attempts (user_id, time, ip_address) to do some sort of rate limiting and/or password brute-forcing detection.

Simple example: if a user contacts you about his account being "hacked" (password was stolen or guessed), you need to have a full log of logins to do any meaningful analysis.

2
  • It is a web app for consumers. Should I do all this logging in a database or a file?
    – Lee
    Jan 12, 2014 at 17:58
  • That's a very broad question with no clear answer. If you want you can provide much more detail and ask a question on stackoverflow.com.
    – Joel L
    Jan 13, 2014 at 12:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .