Fix Insufficient Logging & Monitoring in Actix Web

Insufficient logging is an invitation for persistent threats to live in your infra undetected. If you're running Actix Web without structured telemetry, you're blind to credential stuffing, path traversal attempts, and 500-series crashes that signal exploit development. We're fixing this by implementing the Logger middleware and structured logging to ensure every request leaves a forensic trail.

The Vulnerable Pattern

use actix_web::{web, App, HttpServer, HttpResponse};
#[actix_web::main]
async fn main() -> std::io::Result<()> {
// VULNERABLE: No logging middleware.
// Attacks like SQLi or Brute-force will leave zero footprint in stdout/stderr.
HttpServer::new(|| {
App::new()
.route(“/login”, web::post().to(|| async { HttpResponse::Ok().body(“Login attempt”) }))
})
.bind(“127.0.0.1:8080”)?
.run()
.await
}

The Secure Implementation

The fix involves two critical steps: initializing a global logger (like env_logger or tracing-subscriber) and wrapping the App with Actix's Logger middleware. The vulnerable code fails to record HTTP transactions, making incident response impossible. The secure version uses a custom format string in the Logger middleware to capture the source IP (%a), User-Agent, Request line (%r), Status code (%s), and Response time (%D). This data is essential for identifying patterns of automated scanning and unauthorized access. For high-security environments, replace env_logger with tracing-json to pipe structured logs directly into an ELK stack or Splunk for real-time monitoring and alerting.

use actix_web::{middleware::Logger, web, App, HttpServer, HttpResponse};
use env_logger::Env;
#[actix_web::main]
async fn main() -> std::io::Result<()> {
// Initialize the logger with a default level of ‘info’
env_logger::init_from_env(Env::default().default_filter_or(“info”));
HttpServer::new(|| {
    App::new()
        // SECURE: Logger middleware captures method, path, status, and latency.
        // Use custom formats to include User-Agents and real IP headers for SIEM ingestion.
        .wrap(Logger::new("%a %{User-Agent}i %r %s %b %Dms"))
        .route("/login", web::post().to(|| async { HttpResponse::Ok().body("Logged attempt") }))
})
.bind("127.0.0.1:8080")?
.run()
.await
}