Authentication audit logs now available

TL;DR

• What's new? We've added audit logs to Talo's Authentication service.
• What's changed? You can now monitor all player authentication actions, including registrations, logins, password resets, and more.

Authentication audit logs are here

We've added a new layer of security to Talo's recently released Authentication service: audit logs designed for keeping track of player authentication actions. With the new audit logs, you can monitor all player authentication actions, including registrations, logins, password resets, and more.

What's available in the audit logs?

The following actions are now recorded in the audit logs for individual players:

• Registering: When a player creates a new account.
• Logging in: When a player successfully logs in.
• Logging out: When a player logs out.
• Verification started: When a player starts the verification process.
• Verification failed: When a player fails the verification process.
• Password changed: When a player changes their password.
• Password change failed: When a player fails to change their password.
• Email changed: When a player changes their email address.
• Email change failed: When a player fails to change their email address.
• Password reset requested: When a player requests a password reset.
• Password reset completed: When a player successfully resets their password.

The logs also provide extra details like IP address and user agent to provide additional context for each action. Contextual details are provided for specific actions: for example, when a player changes their email address we'll log the old email address.

Where can I see the audit log?

You can access the audit logs directly from the Talo dashboard. Simply navigate to the Players service, select a player, and their audit logs will be available on their profile if they are using Talo Player Authentication.

New API: toggling verification

We've snuck in a small update to Authentication too!

Previously, players could only enable verification on registration, and now we've added an API to enable verification for existing players. This allows you to require verification for all players, even if they've already registered, or allow players to decide to enhance the security of their account.

Players can also choose to disable verification entirely. Players will need to supply their current password to enable or disable verification.

The new API is now available in our Unity package (v0.20.0) and Godot plugin (v0.4.0), and the existing player authentication documentation has been updated to show how to use this new API.

Feedback and suggestions

We're keen to hear what other items would be useful to include in the audit logs. If you have any feedback or suggestions, please reach out to us on our Discord or raise an issue in our GitHub repository.