- What is laravel-flashlight used for?
- Laravel Flashlight is described as a highly customizable request-logging package for Laravel applications. It integrates through the HTTP middleware stack to capture inbound request metadata such as path, method, status, and timing, then persists it for later inspection. Treat it as a narrow observability or audit capability rather than an application feature.
- Is laravel-flashlight a flash notification package or a request logger?
- The repository describes it as a customizable Laravel package to log requests, not as a flash-message or notification library. The name can suggest flash notifications, so confirm the README and public API before adopting it for user-facing messages. For request history, its documented integration point is HTTP middleware.
- How do I install laravel-flashlight in a Laravel app?
- Installation is typically a Composer require followed by publishing the package config and migrations, then registering the middleware in your HTTP stack. The trial effort is low, but the real work is scoping which routes are logged, which fields are redacted, and how long records are retained. Those are product and compliance decisions, not just engineering tasks.
- Which Laravel and PHP versions does laravel-flashlight support?
- You should verify the declared composer.json constraints for both Laravel and PHP before committing. The package is described as fitting Laravel 10+ services, but Laravel 12 and PHP 8.3+ support must be confirmed against the actual release metadata. Check this against your current and next-upgrade framework baseline.
- Can I customize which routes and request fields are logged?
- The package is positioned as highly customizable, so route scoping and field selection are expected to be configuration concerns. The critical question is whether redaction is default-deny or default-allow for headers, payloads, and cookies. Review the config carefully and build an explicit allowlist before enabling it broadly.
- Does laravel-flashlight capture sensitive data like authorization headers or passwords?
- Request loggers can routinely capture Authorization headers, session cookies, passwords in login POST bodies, and free-text PII unless redaction is configured. Without an explicit redaction allowlist, this becomes a GDPR/CCPA compliance liability and a likely penetration-test finding. Confirm the package's masking behavior and test it against your login and account-update endpoints.
- What is the performance impact of logging every request with laravel-flashlight?
- The dominant performance risk is write amplification: a synchronous database insert on every request can increase DB load and latency on high-traffic endpoints. Confirm whether the write path is synchronous or queued and whether sampling is supported. If not, exclude noisy routes or wrap the writer behind your own queue-aware abstraction.
- Does laravel-flashlight include retention or pruning for stored request logs?
- Retention is a key operational question because request logs grow quickly and often contain sensitive data. Confirm whether the package ships a pruning command or whether you must schedule your own cleanup job. Also check the migration indexes on created_at and user_id, especially if you run MySQL or Postgres with different JSON column behavior.
- How does laravel-flashlight compare with Laravel Telescope, Spatie Activity Log, or web-server access logs?
- Telescope is primarily a local and development debugging tool, Spatie Activity Log targets domain events, and nginx or ALB access logs live at the infrastructure layer. Flashlight's differentiation has to be cheap, queryable, in-app request history for non-technical stakeholders. If that specific need is not articulated, the package is likely redundant with your existing observability stack.
- Is laravel-flashlight production-ready and actively maintained?
- The main risk is maturity rather than technology: low star count, zero dependents, and a single-maintainer project imply limited community validation and bus-factor risk. Minor releases may introduce breaking changes, so pin versions and review the changelog. Wrap the package behind an internal RequestLogWriter contract and avoid coupling application code or dashboards directly to its models or table names.