rappasoft/laravel-authentication-log
Laravel Authentication Log tracks user logins and logouts with IP, browser, location, and device fingerprint, sends alerts for new devices and failed attempts, and adds session management plus suspicious activity detection.
last_activity_at so continuously active sessions do not create duplicate login rows after the original login_at leaves the restoration window (#146).last_activity_at still fall back to login_at during restoration detection.lastLoginAt(), lastSuccessfulLoginAt(), and previousLoginAt() now return \Carbon\CarbonInterface instead of \Illuminate\Support\Carbon, fixing a TypeError in applications that cast model dates to CarbonImmutable (the default in current Laravel starter kits)Full Changelog: https://github.com/rappasoft/laravel-authentication-log/compare/v6.0.1...v6.1.0
use $tableName for the upgrade down migration by @jwpage in https://github.com/rappasoft/laravel-authentication-log/pull/135Full Changelog: https://github.com/rappasoft/laravel-authentication-log/compare/v6.0.0...v6.0.1
This is a major release that modernizes the package for Laravel 11.x and 12.x, adds numerous new features, and fixes several long-standing issues.
Automatically detect and flag suspicious login patterns including:
Configuration:
'suspicious' => [
'failed_login_threshold' => 5,
'check_unusual_times' => false,
'usual_hours' => [9, 10, 11, 12, 13, 14, 15, 16, 17],
],
Comprehensive session management capabilities:
Usage:
$user->getActiveSessions();
$user->revokeSession($sessionId);
$user->revokeAllOtherSessions($currentDeviceId);
$user->revokeAllSessions();
Usage:
$user->getDevices();
$user->trustDevice($deviceId);
$user->untrustDevice($deviceId);
$user->isDeviceTrusted($deviceId);
Powerful query scopes for filtering authentication logs:
successful() - Only successful loginsfailed() - Only failed attemptsfromIp($ip) - Filter by IP addressrecent($hours) - Recent logssuspicious() - Suspicious activitiestrusted() - Trusted devices onlyfromDevice($deviceId) - Specific deviceforUser($user) - Specific useractive() - Active sessionsUsage:
AuthenticationLog::suspicious()->recent(24)->get();
$user->authentications()->failed()->recent(1)->count();
Get authentication statistics for users:
Usage:
$stats = $user->getLoginStats();
$totalLogins = $user->getTotalLogins();
$failedAttempts = $user->getFailedAttempts();
$uniqueDevices = $user->getUniqueDevicesCount();
Prevent notification spam with configurable rate limiting:
Configuration:
'new-device' => [
'rate_limit' => 3,
'rate_limit_decay' => 60, // minutes
],
Restrict access to trusted devices only:
Usage:
Route::middleware(['auth', \Rappasoft\LaravelAuthenticationLog\Middleware\RequireTrustedDevice::class])
->group(function () {
// Protected routes
});
Export authentication logs to CSV or JSON:
Usage:
php artisan authentication-log:export --format=csv --path=storage/app/logs.csv
php artisan authentication-log:export --format=json
Send webhooks for authentication events:
Configuration:
'webhooks' => [
[
'url' => 'https://example.com/webhook',
'events' => ['login', 'failed', 'new_device', 'suspicious'],
'headers' => [
'Authorization' => 'Bearer your-token',
],
],
],
Prevent false positives for new users connecting from multiple devices/locations:
Configuration:
'new-device' => [
'new_user_threshold_minutes' => 1, // Default: 1 minute
],
Fixes #13
Automatically prevents session restorations (page refreshes, remember me cookies) from creating duplicate log entries. Updates last_activity_at instead of creating new entries.
Configuration:
'prevent_session_restoration_logging' => true,
'session_restoration_window_minutes' => 5,
Fixes #40
Browser version updates (e.g., Safari 14.1.2 → 15.1) no longer trigger false "new device" notifications. Device fingerprinting now normalizes user agent strings by removing version numbers.
Fixes #13
Session restorations (page refreshes, remember me cookies) no longer create duplicate log entries. The package now detects and handles session restorations automatically.
Fixed SQL Server error "A column has been specified more than once in the order by list" by removing duplicate orderByDesc('login_at') calls. The authentications() relationship already orders by login_at DESC, so additional ordering was unnecessary.
All listeners now check if the authenticatable model implements the AuthenticationLoggable trait before processing, preventing BadMethodCallException errors when using multiple authenticatable models where only some have the trait.
Fixes #82
Duplicate log entries issue resolved by session restoration prevention (same fix as Issue #13).
Closes #15
The package now sends new device notifications when a successful login occurs after a failed login attempt on an unknown device.
Closes #52
Already implemented. The listener filters to only active sessions using whereNull('logout_at').
Closes #57
Already implemented. The codebase uses null-safe operators (?->) instead of optional().
Closes #80
Already implemented. The AuthenticationLog model includes PHPDoc comments for all properties including new fields.
Closes #85
Added new_user_threshold_minutes configuration option to reduce false positives for users connecting from multiple devices/locations shortly after registration.
Closes #92
Already implemented. The config file includes configurable listeners for all authentication events.
Closes #94
Already implemented. All listeners check if the user model implements the AuthenticationLoggable trait before processing.
Closes #100
Package now supports Laravel 11.x and 12.x.
Closes #115
Config defaults now check if geoip function exists before enabling location tracking, preventing errors when the geoip package is not installed.
Closes #120
Laravel 12 support added and Arabic translation (ar.json) included.
Closes #125
Test configuration updated for Laravel 11+ support.
Closes #127
Spanish translation (es_ES.json) exists and blade templates use the null coalescing operator (??) for state/country fields.
Closes #70
No longer applicable. Package v4.0.0 dropped Laravel 10 support and now only supports Laravel 11.x and 12.x.
composer require rappasoft/laravel-authentication-log
php artisan vendor:publish --provider="Rappasoft\LaravelAuthenticationLog\LaravelAuthenticationLogServiceProvider"
php artisan migrate
composer update rappasoft/laravel-authentication-log
php artisan vendor:publish --provider="Rappasoft\LaravelAuthenticationLog\LaravelAuthenticationLogServiceProvider" --tag="authentication-log-migrations"
php artisan migrate
The upgrade migration will safely add new columns to your existing authentication_log table without data loss.
Thank you to all contributors who submitted issues, pull requests, and feedback that made this release possible!
See the documentation for complete usage instructions and examples.
Note: This release includes breaking changes. Please review the upgrade guide before upgrading from v5.x or earlier.
Full Changelog: https://github.com/rappasoft/laravel-authentication-log/compare/v4.0.0...v5.0.0
Laravel 9 Support
hasTranslations() - https://github.com/rappasoft/laravel-authentication-log/pull/30Initial Release
How can I help you explore Laravel packages today?