- What is dragon-code/laravel-http-logger used for?
- It is a Laravel middleware package that automatically captures incoming HTTP request and response details, including method, URL, status code, timing, selected headers, and payload data. It writes those records through Laravel's native Log facade into configured Monolog channels. Developers use it for debugging, audit trails, and lightweight traffic monitoring without adding manual log statements.
- How do I install laravel-http-logger in a Laravel application?
- Install it with Composer using composer require dragon-code/laravel-http-logger. Laravel package auto-discovery registers the service provider, then you publish the configuration with vendor:publish and adjust the channel, level, include/exclude rules, and redaction settings. Add the middleware to your HTTP kernel or to the specific route groups you want to log.
- Which Laravel and PHP versions does laravel-http-logger support?
- Version 1.6.0 adds Laravel 13 compatibility, so the Composer constraint spans the current framework line and the next major release. You should still confirm the tested PHP 8.x range in composer.json and check whether the project's CI actually exercises Laravel 13 or only widened the constraint. For older Laravel versions, verify the package constraint before installing.
- How do I configure which endpoints are logged?
- The publishable configuration provides include and exclude rules so you can limit logging to specific paths, methods, status codes, or other request characteristics. Exclude health checks, asset requests, webhooks, and other noisy endpoints to reduce log volume and cost. Keep the rules explicit rather than logging every route in production.
- Does laravel-http-logger capture sensitive headers and request bodies?
- HTTP logging can capture Authorization headers, cookies, query strings, and request or response payloads if those fields are enabled. Treat redaction as mandatory: exclude sensitive headers and fields, avoid logging full bodies for authentication or payment routes, and test the output before production. The package offers configuration controls for sensitive data, but you should verify they meet your PII and PCI requirements rather than assuming defaults are safe.
- What is the performance impact of using this package?
- Logging runs as synchronous middleware in the request path, so every captured request adds write I/O and serialization overhead. There are no built-in sampling controls in 1.6.0, so use include/exclude rules, a fast channel, and selective payload capture to control volume. Benchmark under realistic traffic and be careful with body logging on high-throughput endpoints.
- Is laravel-http-logger safe to use with Laravel Octane?
- There is no explicit Octane-safety statement in the 1.6.0 release, so you should test it under Octane before relying on it. The middleware writes through Laravel's logging system, which is generally compatible, but long-running workers make configuration caching, channel behavior, and request state worth verifying. Avoid capturing large payloads and confirm log writers do not retain per-request state.
- What are the production risks of HTTP request logging in Laravel?
- The main risks are data exposure from headers and payloads, disk-fill or log amplification from high traffic, and log injection from user-controlled URLs and headers written to line-oriented sinks. Use a dedicated channel with rotation and retention limits, redact sensitive fields, exclude noisy routes, and monitor log volume. Also check how writer failures are handled so logging errors do not break requests.
- How does laravel-http-logger compare with Laravel Telescope or Sentry and Datadog?
- This package is a lightweight middleware logger that writes request and response records into Monolog channels; Telescope is a development debugging tool, while Sentry, Datadog, and New Relic provide APM tracing and alerting. It overlaps with those tools but offers fast setup and config-driven field selection rather than unique capabilities. Use it for simple audit or debug logs, not as a replacement for full observability or security monitoring.
- Is laravel-http-logger actively maintained, or should I fork it?
- The project has low adoption, a single maintainer, and has been reported as archived, yet version 1.6.0 includes a human-authored Laravel 13 compatibility pull request, which is a contradictory maintenance signal. There is no formal support commitment or CVE pipeline, so treat the Laravel 13 patch as buying time rather than retiring abandonment risk. For long-term production use, audit the source and plan to fork, vendor, or reimplement before Laravel 14.