Weave Code
Auth Log Bundle Laravel Package
spiriitlabs/auth-log-bundle
Symfony bundle for tracking authentication activity. It records login successes, failures, and logouts with context such as user, IP address, and user agent, then stores events for auditing and review through configurable persistence and a simple dashboard.
Symfony authentication audit log with geolocation, device detection and security notifications
Frequently asked questions about Auth Log Bundle
- Is spiriitlabs/auth-log-bundle a Laravel package?
- No. It is a Symfony bundle that integrates through Symfony's bundle system, DI container and Security component events, so it is not directly installable in a Laravel application. If your target is Laravel, you would need a custom bridge or a different package built around Laravel's authentication events.
- How do I install and register spiriitlabs/auth-log-bundle?
- Install it with Composer, enable the bundle in your Symfony bundle configuration, and create the auth-log database table with a Doctrine migration. Then configure the location provider if you want IP geolocation. Once the schema is in place, the event subscribers record login successes, failures and logouts without additional wiring.
- Which Symfony and PHP versions does v4.0.2 support?
- The release notes do not state the exact version matrix, so verify the require constraints in the package's composer.json before adopting it. The assessment indicates it fits Symfony 6 and 7 applications that use the Security component and Doctrine. Confirm that the declared range covers your supported LTS before committing engineering time.
- What authentication events does this bundle record?
- It hooks into Symfony Security events for successful login, failed login and logout. Each record captures the user, IP address, user agent and timestamp. The bundle ships a Doctrine entity and a ready-to-use repository so you can query or export the trail for monitoring and investigations.
- Does geolocation block the login request?
- Location resolution happens as part of recording the authentication event, and v4.0.2 adds a timeout for API-based lookups so an outbound request cannot stall indefinitely. GeoIP2 with a local MaxMind database is the recommended production choice because it avoids a network call on the login path. Treat the timeout as a latency mitigation, not a guarantee, and check whether the timeout is tunable in bundle configuration.
- What storage does auth-log-bundle use?
- It persists records through Doctrine using a bundled entity and repository, so you need a schema migration for the auth-log table. The assessment flags storage provider as a question to verify, including whether Doctrine ODM or custom persistence is supported. Confirm your expected write volume and whether you need a pruning or retention mechanism.
- What changed in v4.0.2 and is it a breaking change?
- The release is a patch with a timeout fix for API location lookup, dependency housekeeping that moves Messenger and HttpClient to suggest, and CI hardening with static analysis. It does not change the architectural contract. Still verify composer.json rather than relying on the changelog, because any implicit transitive dependency change can affect existing installs.
- Why were Symfony Messenger and HttpClient moved to suggest?
- Moving them to suggest makes optional features genuinely optional, which is the right direction for a focused audit logger. The risk is that an application relying on those packages being installed transitively could silently lose async location resolution or hit a missing HTTP client at runtime. Check your composer.json and install them explicitly if you use those paths.
- How should I handle GDPR and retention for authentication logs?
- Auth logs contain IP addresses and potentially geolocation, which are personal data under GDPR. The package records events but does not enforce retention periods, access control or lawful basis, so those are application-level obligations. Define a retention and pruning policy, restrict access to the trail, and document your lawful basis before enabling it in production.
- What are alternatives if I am using Laravel or need a simpler audit trail?
- For Laravel, use packages or listeners built around Laravel's authentication events rather than this Symfony bundle. For Symfony, a custom Security event subscriber writing to Monolog or your own entity may be enough if you do not need the bundled repository and dashboard. Test any option by dispatching login success, failure and logout events in functional tests and asserting the persisted records.
Weaver
How can I help you explore Laravel packages today?