Track CSRF error in metrics

ref DEV-2911

Author: louischan-oursky

.vettedpositions

@@ -172,8 +172,8 @@
 /pkg/auth/handler/webapp/create_passkey.go:53:27: requestcontext
 /pkg/auth/handler/webapp/create_password.go:107:27: requestcontext
 /pkg/auth/handler/webapp/csrf_error_instruction.go:49:36: requestcontext
-/pkg/auth/handler/webapp/csrf_middleware.go:73:5: requestcontext
-/pkg/auth/handler/webapp/csrf_middleware.go:84:9: requestcontext
+/pkg/auth/handler/webapp/csrf_middleware.go:74:5: requestcontext
+/pkg/auth/handler/webapp/csrf_middleware.go:85:9: requestcontext
 /pkg/auth/handler/webapp/enter_login_id.go:144:27: requestcontext
 /pkg/auth/handler/webapp/enter_login_id.go:146:31: requestcontext
 /pkg/auth/handler/webapp/enter_oob_otp.go:161:27: requestcontext

pkg/auth/handler/webapp/csrf_middleware.go

@@ -2,6 +2,7 @@ package webapp
 
 import (
 	"encoding/base64"
+	"errors"
 	"fmt"
 	"log/slog"
 	"net/http"
@@ -82,11 +83,6 @@ func (m *CSRFMiddleware) Handle(next http.Handler) http.Handler {
 
 func (m *CSRFMiddleware) unauthorizedHandler(w http.ResponseWriter, r *http.Request) {
 	ctx := r.Context()
-	otelutil.IntCounterAddOne(
-		ctx,
-		otelauthgear.CounterCSRFRequestCount,
-		otelauthgear.WithStatusError(),
-	)
 
 	// Check debug cookies and inject info for reporting
 	omitCookie, err := m.Cookies.GetCookie(r, webapp.CSRFDebugCookieSameSiteOmitDef)
@@ -107,6 +103,35 @@ func (m *CSRFMiddleware) unauthorizedHandler(w http.ResponseWriter, r *http.Requ
 	maskedCsrfCookieContent := ""
 	securecookieError := ""
 	csrfFailureReason := csrf.FailureReason(r)
+
+	otelutil.IntCounterAddOne(
+		ctx,
+		otelauthgear.CounterCSRFRequestCount,
+		otelauthgear.WithStatusError(),
+		otelauthgear.WithCSRFHasOmitCookie(hasOmitCookie),
+		otelauthgear.WithCSRFHasNoneCookie(hasNoneCookie),
+		otelauthgear.WithCSRFHasLaxCookie(hasLaxCookie),
+		otelauthgear.WithCSRFHasStrictCookie(hasStrictCookie),
+		otelauthgear.WithGorillaCSRFFailureReason(func() string {
+			var val string
+			switch {
+			case errors.Is(csrfFailureReason, csrf.ErrNoReferer):
+				val = "ErrNoReferer"
+			case errors.Is(csrfFailureReason, csrf.ErrBadOrigin):
+				val = "ErrBadOrigin"
+			case errors.Is(csrfFailureReason, csrf.ErrBadReferer):
+				val = "ErrBadReferer"
+			case errors.Is(csrfFailureReason, csrf.ErrNoToken):
+				val = "ErrNoToken"
+			case errors.Is(csrfFailureReason, csrf.ErrBadToken):
+				val = "ErrBadToken"
+			default:
+				val = "unknown"
+			}
+			return val
+		}()),
+	)
+
 	if csrfCookie != nil {
 		// do not return value but length only for debug.
 		csrfCookieSizeInBytes = len([]byte(csrfCookie.Value))
@@ -147,6 +172,7 @@ func (m *CSRFMiddleware) unauthorizedHandler(w http.ResponseWriter, r *http.Requ
 	}
 
 	logger := CSRFMiddlewareLogger.GetLogger(ctx)
+
 	logger.With(
 		slog.Bool("hasOmitCookie", hasOmitCookie),
 		slog.Bool("hasNoneCookie", hasNoneCookie),
@@ -156,7 +182,7 @@ func (m *CSRFMiddleware) unauthorizedHandler(w http.ResponseWriter, r *http.Requ
 		slog.String("maskedCsrfCookieContent", maskedCsrfCookieContent),
 		slog.String("securecookieError", securecookieError),
 		slog.Any("csrfFailureReason", csrfFailureReason),
-	).Error(ctx, "CSRF Forbidden")
+	).WithSkipLogging().Error(ctx, "CSRF Forbidden")
 
 	uiImpl := m.UIImplementationService.GetUIImplementation()
 

pkg/lib/otelauthgear/metric.go

@@ -94,6 +94,21 @@ var AttributeStatusOK = AttributeKeyStatus.String("ok")
 // AttributeStatusError is "status=error".
 var AttributeStatusError = AttributeKeyStatus.String("error")
 
+// AttributeKeyCSRFHasOmitCookie defines the attribute.
+var AttributeKeyCSRFHasOmitCookie = attribute.Key("csrf.has_omit_cookie")
+
+// AttributeKeyCSRFHasNoneCookie defines the attribute.
+var AttributeKeyCSRFHasNoneCookie = attribute.Key("csrf.has_none_cookie")
+
+// AttributeKeyCSRFHasLaxCookie defines the attribute.
+var AttributeKeyCSRFHasLaxCookie = attribute.Key("csrf.has_lax_cookie")
+
+// AttributeKeyCSRFHasStrictCookie defines the attribute.
+var AttributeKeyCSRFHasStrictCookie = attribute.Key("csrf.has_strict_cookie")
+
+// AttributeKeyGorillaCSRFFailureReason defines the attribute.
+var AttributeKeyGorillaCSRFFailureReason = attribute.Key("gorilla_csrf.failure_reason")
+
 var CounterOAuthSessionCreationCount = otelutil.MustInt64Counter(
 	meter,
 	"authgear.oauth_session.creation.count",
@@ -171,6 +186,10 @@ var CounterWhatsappRequestCount = otelutil.MustInt64Counter(
 
 // CounterCSRFRequestCount has the following labels:
 // - AttributeKeyStatus
+// - AttributeKeyCSRFHasOmitCookie
+// - AttributeKeyCSRFHasNoneCookie
+// - AttributeKeyCSRFHasLaxCookie
+// - AttributeKeyCSRFHasStrictCookie
 var CounterCSRFRequestCount = otelutil.MustInt64Counter(
 	meter,
 	"authgear.csrf.request.count",
@@ -252,6 +271,26 @@ func WithHTTPStatusCode(code int) otelutil.MetricOption {
 	return metricOptionAttributeKeyValue{semconv.HTTPResponseStatusCodeKey.Int(code)}
 }
 
+func WithCSRFHasOmitCookie(b bool) otelutil.MetricOption {
+	return metricOptionAttributeKeyValue{AttributeKeyCSRFHasOmitCookie.Bool(b)}
+}
+
+func WithCSRFHasNoneCookie(b bool) otelutil.MetricOption {
+	return metricOptionAttributeKeyValue{AttributeKeyCSRFHasNoneCookie.Bool(b)}
+}
+
+func WithCSRFHasLaxCookie(b bool) otelutil.MetricOption {
+	return metricOptionAttributeKeyValue{AttributeKeyCSRFHasLaxCookie.Bool(b)}
+}
+
+func WithCSRFHasStrictCookie(b bool) otelutil.MetricOption {
+	return metricOptionAttributeKeyValue{AttributeKeyCSRFHasStrictCookie.Bool(b)}
+}
+
+func WithGorillaCSRFFailureReason(reason string) otelutil.MetricOption {
+	return metricOptionAttributeKeyValue{AttributeKeyGorillaCSRFFailureReason.String(reason)}
+}
+
 func SetProjectID(ctx context.Context, projectID string) {
 	labeler, _ := otelhttp.LabelerFromContext(ctx)
 	labeler.Add(attributeKeyProjectID.String(projectID))