spatie/laravel-http-logger

The package uses two main abstractions to handle logging:

1. LogProfile: Determines if a request should be logged. You must implement the shouldLogRequest(Request $request): bool method. The default implementation (LogNonGetRequests) only logs POST, PUT, PATCH, DELETE, and QUERY requests.

2. LogWriter: Determines how the request is written. You must implement the logRequest(Request $request): void method. The default implementation (DefaultLogWriter) writes the method, URI, and body (excluding fields in the except config) to the configured Laravel log channel.

You can swap these out in config/http-logger.php to implement custom logic.

// Example LogProfile implementation
public function shouldLogRequest(Request $request): bool
{
   return in_array(strtolower($request->method()), ['post', 'put', 'patch', 'delete', 'query']);
}

// Example LogWriter implementation
public function logRequest(Request $request): void
{
    $method = strtoupper($request->getMethod());
    $uri = $request->getPathInfo();
    $bodyAsJson = json_encode($request->except(config('http-logger.except')));
    $message = "{$method} {$uri} - {$bodyAsJson}";

    Log::channel(config('http-logger.log_channel'))->info($message);
}

The configuration file config/http-logger.php allows you to control how requests are logged. Key options include:

• enabled: Boolean to toggle the middleware (controlled via HTTP_LOGGER_ENABLED env var).
• log_profile: A class implementing LogProfile that decides if a request should be logged.
• log_writer: A class implementing LogWriter that handles the actual writing of the log.
• log_channel: The Laravel log channel to use (e.g., stack).
• log_level: The log level (e.g., info).
• except: An array of body fields to exclude from logs (e.g., password).
• sanitize_headers: An array of header names to be masked in the logs.

return [

    /*
     * Determine if the http-logger middleware should be enabled.
     */
    'enabled' => env('HTTP_LOGGER_ENABLED', true),

    /*
     * The log profile which determines whether a request should be logged.
     * It should implement `LogProfile`.
     */
    'log_profile' => \Spatie\HttpLogger\LogNonGetRequests::class,

    /*
     * The log writer used to write the request to a log.
     * It should implement `LogWriter`.
     */
    'log_writer' => \Spatie\HttpLogger\DefaultLogWriter::class,
    
    /*
     * The log channel used to write the request.
     */
    'log_channel' => env('LOG_CHANNEL', 'stack'),
    
    /*
     * The log level used to log the request.
     */
    'log_level' => 'info',
    
    /*
     * Filter out body fields which will never be logged.
     */
    'except' => [
        'password',
        'password_confirmation',
    ],
    
    /*
     * List of headers that will be sanitized. For example Authorization, Cookie, Set-Cookie...
     */
    'sanitize_headers' => [],
];

The Sanitizer class is used to mask sensitive information within request data (like passwords or API keys) before it is logged. It works by recursively traversing an array and replacing values associated with specified keys with a mask string.

Key Methods:

• clean(array $input, $keys): Recursively scans the $input array. If a key matches any of the provided $keys (case-insensitive), its value is replaced by the mask. If the value is an array, it is replaced by an array containing the mask.
• setMask(string $mask): Updates the string used to replace sensitive values.
• normalize(string $string): A helper method used to normalize keys (defaults to strtolower). You can override this to change how keys are matched.

use Spatie\HttpLogger\Sanitizer;

$sanitizer = new Sanitizer('REDACTED');

$data = [
    'user' => [
        'name' => 'John Doe',
        'password' => 'secret123',
    ],
    'api_key' => 'abc-123',
];

$cleanData = $sanitizer->clean($data, ['password', 'api_key']);

// Result:
// [
//     'user' => [
//         'name' => 'John Doe',
//         'password' => 'REDACTED',
//     ],
//     'api_key' => 'REDACTED',
// ]