Feature request: Include user email in successful login logs

[lmogthb]

Description

Vaultwarden currently logs failed and successful login attempts using different user identifiers.

A failed login is logged as:

Username or password is incorrect. IP: X.X.X.X Username: {user.email}

A successful login is logged as:

User {user.DisplayName} logged in successfully. IP: X.X.X.X

A successful login via API KEY already logs the email, but not the above ones

This makes it difficult to correlate failed and successful authentication events in SIEM platforms, since one event uses the email address while the other uses the display name.

Why this is a problem

From a security monitoring perspective, email addresses are the most stable user identifier.

Display names:

• Can contain spaces.
• Can be modified by users.
• Are not guaranteed to be unique.
• Are difficult to correlate with previous failed login attempts.

As a result, detecting scenarios such as:

• Multiple failed logins against an account followed by a successful login.
• Credential stuffing.
• Brute-force attacks.
• Account compromise.

becomes unnecessarily difficult.

Proposed solution

Include both the display name and the email address in successful login events.

For example:

User {user.DisplayName} logged in successfully. Email: {user.email}. IP: X.X.X.X

This would preserve the existing display name while providing a stable identifier for security monitoring.

Privacy considerations

If exposing email addresses in logs is considered too sensitive for some deployments, this behaviour could be made configurable, for example:

LOG_SUCCESSFUL_LOGIN_EMAIL=true

or enabled only when running with an extended/audit logging mode.

Benefits

• Consistent authentication logging.
• Easier SIEM integration.
• Reliable correlation between failed and successful logins.
• Better incident response and forensic investigations.
• Improved detection of credential stuffing and brute-force attacks.

Thank you for considering this enhancement.

[RaphaelRoumezin]

To be pedantic, the logging uses user.display_name(), which returns the email if no display name is set for the user.

vaultwarden/src/api/identity.rs

Line 579 in 169aa5e

info!("User {} logged in successfully. IP: {}", user.display_name(), ip.ip);

vaultwarden/src/db/models/user.rs

Lines 244 to 251 in 169aa5e

	pub fn display_name(&self) -> &str {
	// default to email if name is empty
	if self.name.is_empty() {
	&self.email
	} else {
	&self.name
	}
	}

Either way, I don't really believe there is a privacy consideration, since the API key login logs the email every time, and I agree using the email would be a better approach for auditable logs.