Log events
Event ids are stable across releases. An id is never reused for a different event, so it is safe to alert on one.
| Id | Level | Event |
|---|---|---|
| 1000 | Debug | Request signed |
| 1001 | Warning | Signing produced no HMAC |
| 1002 | Trace | Signing content computed |
| 1003 | Warning | Outgoing request not sent |
| 1100 | Debug | Request verified |
| 1101 | Warning | Scheme headers missing |
| 1102 | Warning | Request outside the max-age window |
| 1103 | Warning | Nonce replayed |
| 1104 | Warning | Signature mismatch |
| 1105 | Trace | Signature mismatch detail |
| 1200 | Debug | Policy not found |
| 1201 | Warning | Nonce cache not registered |
| 1202 | Debug | Scheme not declared by the policy |
| 1203 | Warning | Distributed nonce cache backed by the in-process MemoryDistributedCache, logged once at startup |
| 1210 | Information | Watching configuration for policy changes |
| 1211 | Information | Policies reloaded |
| 1212 | Warning | Policy reload failed, previous set retained |
| 1300 | Debug | No HMAC header; authentication skipped |
| 1301 | Warning | OnValidateKeys rejected the credentials |
| 1302 | Debug | Authentication succeeded |
| 1303 | Warning | Authentication failed |
| 1304 | Debug | Authentication rejected because a required HMAC header is missing or malformed |
| 1310 | Debug | Requested policy not registered |
| 1400 | Warning | Nonce claim failed in Redis; the request fails |
| 1401 | Warning | Redis connection lost |
| 1402 | Information | Redis connection restored |
Ranges
| Range | Emitted by |
|---|---|
| 1000–1099 | Signing |
| 1100–1199 | Verification |
| 1200–1299 | Factory resolution and policy reloading |
| 1300–1399 | The authentication handler |
| 1400–1499 | The Redis nonce cache, from HmacManager.StackExchangeRedis |
Reading a rejection
Each failure mode has its own id, so the id alone says what went wrong:
| Seeing | Means |
|---|---|
| 1102 | Clocks disagree by more than the replay window, or the request really is old |
| 1103 | The same nonce twice — a genuine replay, or a client reusing one |
| 1104 | The two sides built different signing content |
| 1101 | A scheme header was missing from the request |
| 1310 / 1200 | The request named a policy this host does not have |
| 1202 | The request named a scheme that policy does not declare — usually a typo |
| 1300 | Not an HMAC request at all — no header, so authentication was skipped |
| 1304 | A required HMAC header was missing or malformed, including invalid base64 in Hmac-Options |
For 1104, turn on Trace and compare event 1002 on the signer against 1105 on
the verifier. See
diagnosing a mismatch.
Caller-controlled rejections — 1300, 1304, 1310, 1200, 1202 — are Debug, not
Warning. An unauthenticated caller can produce them at will, and an edge
deployment must not be drivable to unbounded Warning volume by traffic anyone
can send.
Private keys
No message at any level carries a private key. A test asserts this over the full sign/verify path with every level enabled.
Signing content (1002, 1105) is not secret — it travels with the request — but
it does contain the public key, the nonce and any scheme header values, which
may identify a user. That is why it is Trace and off by default.