Access Log Middleware

After you require the package. When you do php artisan migrate you will notice a new migration/table getting migrated.

It is the create_access_logs_table migration.

That is because the AccessLogMiddleware saves logged api endpoints in this table.

• Usage
• Result
• Redaction
• Pruning

Usage

To use the AccessLogMiddleware, all you have to do is wrap the middleware access.log around your desired endpoints like below

// api.php

Route::middleware(['access.log'])->group(function () {
    Route::get('/hello', function () {
        return 'Hello World';
    });
});

Result

After you wrapped the access.log middleware around your api endpoints.

Now, if you hit that endpoint yourUrl:8000/hello it will return the string Hello World.

If you go to your access log table now you will see that the endpoint information were saved to the access log database table.

It has information like:

1. The Ip Address
2. The Method Type (Get, Post, Put, Delete, Options, and Etc...)
3. The Endpoint Url
4. The User Agent
5. The Request Data (If it a Post/Put Request)
6. The Timestamps (Created At, and Updated At)

• Publish Models & Migrations

Redaction

Request bodies are recorded, so credentials must not be. Anything matching the exclusion list is dropped from both the stored body and the query string before the row is written:

password, password_confirmation, remember_token,
api_token, access_token, refresh_token, secret, token

A login request therefore records who tried to sign in without recording what they typed:

{"email": "user@example.com"}

The list is shared with the audit trail by default. Override it independently when the access log needs different rules:

'access_log' => [
    'excluded_attributes' => ['password', 'pin', 'otp'],
],

Setting it to null falls back to lara-util-x.audit.excluded_attributes.

Changed in v1.5.4. Earlier releases stored json_encode($request->all()) verbatim, so placing the middleware on a login route wrote plaintext passwords into access_logs, and fullUrl() persisted any token passed as a query parameter. If you have been running this middleware on authentication routes, treat the existing rows as compromised credentials and purge them.

Pruning

Access logs accumulate on every request. AccessLog is prunable, so Laravel's scheduled pruning clears out old rows:

php artisan model:prune

Schedule it alongside your other maintenance tasks:

use Illuminate\Support\Facades\Schedule;

Schedule::command('model:prune')->daily();

Retention is configurable, and null keeps rows indefinitely:

'access_log' => [
    'retention_days' => 30,
],

Added in v1.5.4. The table previously grew without bound.

Publish Models & Migrations

You can optionally publish the Models and the Migrations of this package If you want to customize anything:

Models:

You can publish the package's models through this command:

php artisan vendor:publish --tag=lara-util-x-models

Migrations

You can publish the package's migrations through this command:

php artisan vendor:publish --tag=lara-util-x-migrations