Token registrations are rare and security-sensitive. We want a complete audit trail of each registration ceremony for debugging and compliance purposes.
What to do
- Add structured log entries during registration covering:
- The
attestationObject and clientDataJSON returned by the token
- The token AAGUID
- The matched MDS metadata statement
- Each ceremony step that is invoked and its result, especially attestation validation
Acceptance criteria
- A full registration ceremony produces log entries for each of the above points
- Log level is appropriate (info/debug) — verbose is acceptable since registrations are rare
- No sensitive credential material is logged in a way that could be exploited
- A whole registration flow is traceable by 1 id
- look for the posibility to silence the lib log for full request logs
Token registrations are rare and security-sensitive. We want a complete audit trail of each registration ceremony for debugging and compliance purposes.
What to do
attestationObjectandclientDataJSONreturned by the tokenAcceptance criteria