- How do I install rappasoft/laravel-authentication-log in a Laravel app?
- Run composer require rappasoft/laravel-authentication-log, then add the AuthenticationLoggable trait to your authenticatable model. Publish the bundled migrations with vendor:publish and run php artisan migrate; the config file is optional but worth publishing so you can tune notifications and GeoIP. Baseline setup is low effort because the package hooks into Laravel's existing login, logout, and failed-login events rather than replacing your auth flow.
- Which Laravel and PHP versions does laravel-authentication-log support?
- Version 6 requires Laravel 11 or 12 and PHP 8.1 or higher, and the 6.1 release adds Laravel 13 support plus immutable date casting compatibility. Projects still on Laravel 10 must pin to v3, which caps the available feature set, so plan an upgrade path before adopting it. Check Packagist and the live repository for the current support matrix before committing.
- Does session revocation work with Redis or file session drivers?
- Session revocation is driver-dependent: revokeSession and revokeAllOtherSessions only take effect when sessions are stored somewhere the package can reach, which in practice usually means the database driver. With Redis or file sessions, revocation can be a silent no-op that looks like success, which is a security-relevant failure. Test revocation explicitly in your actual session configuration before relying on it in production.
- Why do users get new device notifications after a routine browser update?
- Device identity is a SHA-256 hash of a normalized user agent string, so a browser update that changes the UA can register as a new device. Version 6 added browser version normalization to reduce these false positives, but you should still expect to tune the normalization rules and notification thresholds. The trade-off is precision in the other direction: genuinely different devices sharing the same UA will be merged into one fingerprint.
- How do I handle multiple authenticatable models like User and Admin with this package?
- Add the AuthenticationLoggable trait to every model that should be tracked, such as User and Admin, and each will write its own log records. The package ships no routing or UI, so you decide whether the admin surface is a single unified view or per-model screens. The AuthenticationLog model's query scopes, including successful, failed, suspicious, active, trusted, fromIp, and recent, are what you build those views against.
- Can I customize new device and failed login notifications to use mail, Slack, or SMS?
- Yes. Notifications reuse Laravel's native notification system, so your existing mail, Slack, and SMS channels and queue workers carry over. Channels are configurable, and each optional capability can be adopted independently, which supports a phased rollout. Make sure queue capacity and rate limits are configured so a burst of failed logins does not flood users or your providers.
- How does suspicious login detection work and how do I reduce false positives?
- Suspicious activity detection is heuristic: it looks for patterns such as multiple failed logins, a rapid country change, and logins at unusual hours, and the location-based checks depend on a GeoIP provider. Because these are heuristics, false positives are expected and drive alert fatigue if thresholds are left at defaults. Decide explicitly on your GeoIP provider's accuracy, latency, and data residency, then tune the thresholds against real traffic.
- Does laravel-authentication-log include a UI or dashboard for viewing logs and sessions?
- No UI is shipped. The package is deliberately a data and policy layer that adds a trait, an AuthenticationLog Eloquent model, and query scopes, without imposing routes or views. Session lists, device trust screens, and suspicious-activity dashboards are yours to build, so budget that product surface work as the real cost of adoption rather than the installation.
- How do I prune old authentication log records for GDPR and data retention?
- The log table grows one row per login, logout, and failed attempt, so index design and a retention policy matter more than your database engine. The stored IP, user agent, and geolocation data are personal data subject to retention limits, access control, and export governance. Define a retention period with legal sign-off, schedule purges with a Laravel scheduled command, and secure the built-in CSV and JSON export features since they are a convenient data-egress path.
- Is the package actively maintained, and should I fork it?
- Supply-chain signals are mixed: there are roughly 1,000 GitHub stars with solid docs, changelog, and releases, but some index signals such as dependent counts and release dates look anomalous. Verify the current state on Packagist and the live repository before committing, and treat single-maintainer bus factor as a genuine risk. If that risk is unacceptable, plan for a vendored fork with clearly assigned upgrade ownership, or evaluate alternatives that are part of a larger maintained ecosystem.