Laravel HTTP Logger

https://github.com/spatie/laravel-http-logger
Admin
A Laravel package that provides a middleware to log incoming HTTP requests, acting as an extra...
Tokens:21,414
Snippets:143
Trust Score:10
License:MIT
Update:3 weeks ago
Show doc for...
Tokens:
Raw
### Install via Composer

Source: https://github.com/spatie/laravel-http-logger/blob/main/README.md

Install the package using Composer.

```bash
composer require spatie/laravel-http-logger
```

--------------------------------

### Reading merged configuration at runtime

Source: https://github.com/spatie/laravel-http-logger/blob/main/_autodocs/api-reference/HttpLoggerServiceProvider.md

Example of how the package's own classes resolve the LogWriter and LogProfile singletons and read the 'http-logger.enabled' config value.

```php
$writer   = app(LogWriter::class);            // DefaultLogWriter by default
$profile  = app(LogProfile::class);           // LogNonGetRequests by default
$enabled  = config('http-logger.enabled');    // HTTP_LOGGER_ENABLED, default true
```

--------------------------------

### Implement LogProfile to log only store routes

Source: https://github.com/spatie/laravel-http-logger/blob/main/_autodocs/api-reference/LogProfile.md

Example implementation of LogProfile that logs only POST requests to paths starting with 'store'. This class is then registered in the config file.

```php
use Illuminate\Http\Request;
use Spatie\HttpLogger\LogProfile;

class LogOnlyStoreRoutes implements LogProfile
{
    public function shouldLogRequest(Request $request): bool
    {
        return $request->isMethod('POST')
            && str_starts_with($request->path(), 'store');
    }
}
```

```php
// config/http-logger.php
'log_profile' => \App\Http\Logging\LogOnlyStoreRoutes::class,
```

--------------------------------

### Implement LogWriter with AuditLogWriter

Source: https://github.com/spatie/laravel-http-logger/blob/main/_autodocs/api-reference/LogWriter.md

Example implementation that logs the request method, full URL, and input (excluding password fields) to an 'audit' channel. This is a complete custom writer that can be registered in the config.

```php
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Log;
use Spatie\HttpLogger\LogWriter;

class AuditLogWriter implements LogWriter
{
    public function logRequest(Request $request)
    {
        Log::channel('audit')->info(json_encode([
            'method' => $request->method(),
            'url'    => $request->fullUrl(),
            'input'  => $request->except(['password', 'password_confirmation']),
        ]));
    }
}
```

--------------------------------

### Basic usage of LogNonGetRequests

Source: https://github.com/spatie/laravel-http-logger/blob/main/_autodocs/api-reference/LogNonGetRequests.md

Example of using LogNonGetRequests to check if requests with POST, GET, and QUERY methods should be logged. Outputs bool(true), bool(false), bool(true) respectively.

```php
use Spatie\HttpLogger\LogNonGetRequests;
use Illuminate\Http\Request;

$profile = new LogNonGetRequests();

var_dump($profile->shouldLogRequest(Request::create('/form', 'POST')));   // bool(true)
var_dump($profile->shouldLogRequest(Request::create('/form', 'GET')));    // bool(false)
var_dump($profile->shouldLogRequest(Request::create('/api', 'QUERY')));   // bool(true)
```

--------------------------------

### Implement LogWriter with dependency injection

Source: https://github.com/spatie/laravel-http-logger/blob/main/_autodocs/api-reference/LogWriter.md

Example implementation that uses constructor injection to receive a LogRepository dependency. It records the method, path info, and payload (excluding sensitive fields) to the repository.

```php
use Illuminate\Http\Request;
use Spatie\HttpLogger\LogWriter;

class HttpLogWriter implements LogWriter
{
    public function __construct(private LogRepository $repository)
    {
    }

    public function logRequest(Request $request)
    {
        $this->repository->record(
            method: $request->method(),
            uri: $request->getPathInfo(),
            payload: $request->except(config('http-logger.except')),
        );
    }
}
```

--------------------------------

### Custom Log Profile Implementation

Source: https://github.com/spatie/laravel-http-logger/blob/main/README.md

Example implementation of the LogProfile interface's shouldLogRequest method, which determines whether a request should be logged. This example logs only non-GET requests.

```php
// Example implementation from `\Spatie\HttpLogger\LogNonGetRequests`

public function shouldLogRequest(Request $request): bool
{
   return in_array(strtolower($request->method()), ['post', 'put', 'patch', 'delete', 'query']);
}
```

--------------------------------

### setMask() usage example

Source: https://github.com/spatie/laravel-http-logger/blob/main/_autodocs/api-reference/Sanitizer.md

Shows how to change the mask from '****' to '###' using setMask(). The first clean() returns ['x-api-key' => ['****']], the second returns ['x-api-key' => ['###']].

```php
use Spatie\HttpLogger\Sanitizer;

$sanitizer  = new Sanitizer();
$redactAll  = ['x-api-key' => ['sk-live-123']];

$first = $sanitizer->clean($redactAll, ['x-api-key']);
// ['x-api-key' => ['****']]

$sanitizer->setMask('###');
$second = $sanitizer->clean($redactAll, ['x-api-key']);
// ['x-api-key' => ['###']]
```

--------------------------------

### Interacting with the enabled flag

Source: https://github.com/spatie/laravel-http-logger/blob/main/_autodocs/api-reference/LogNonGetRequests.md

Example showing how the 'http-logger.enabled' config affects the result. When set to false, even POST requests are not logged.

```php
use Spatie\HttpLogger\LogNonGetRequests;
use Illuminate\Http\Request;

$profile = new LogNonGetRequests();
$request = Request::create('/lead', 'POST');

config(['http-logger.enabled' => true]);
var_dump($profile->shouldLogRequest($request)); // bool(true)

config(['http-logger.enabled' => false]);
var_dump($profile->shouldLogRequest($request)); // bool(false) even though method is POST
```

--------------------------------

### Usage example for DefaultLogWriter::getMessage()

Source: https://github.com/spatie/laravel-http-logger/blob/main/_autodocs/api-reference/DefaultLogWriter.md

Shows how to instantiate DefaultLogWriter and call getMessage() with a request created via Request::create(). The resulting message array contains the expected method, uri, and body values.

```php
$writer = new DefaultLogWriter();
$message = $writer->getMessage(Request::create('/api/orders', 'PUT', ['qty' => 3]));
// $message['method'] === 'PUT'
// $message['uri']    === '/api/orders'
// $message['body']   === ['qty' => 3]
```

--------------------------------

### Custom LogProfile implementation

Source: https://github.com/spatie/laravel-http-logger/blob/main/_autodocs/api-reference/LogNonGetRequests.md

Example of a custom LogProfile class that logs all requests except those to health endpoints. This is a reference for implementing your own profile.

```php
use Illuminate\Http\Request;
use Spatie\HttpLogger\LogProfile;

class LogAllRequestsExceptHealthChecks implements LogProfile
{
    public function shouldLogRequest(Request $request): bool
    {
        if ($request->is('health*')) {
            return false;
        }

        return true;
    }
}
```

--------------------------------

### Implement LogProfile with dependency injection

Source: https://github.com/spatie/laravel-http-logger/blob/main/_autodocs/api-reference/LogProfile.md

Example implementation of LogProfile that uses constructor injection to resolve a TenantResolver dependency. The middleware resolves the profile via the container, so dependencies are automatically injected.

```php
use Illuminate\Http\Request;
use Spatie\HttpLogger\LogProfile;

class LogForTenant implements LogProfile
{
    public function __construct(private TenantResolver $tenants)
    {
    }

    public function shouldLogRequest(Request $request): bool
    {
        return $this->tenants->current() !== null;
    }
}
```

--------------------------------

### Sanitize request headers with clean()

Source: https://github.com/spatie/laravel-http-logger/blob/main/_autodocs/api-reference/Sanitizer.md

Example of sanitizing a typical header map. Keys are matched case-insensitively; array values become ['****'] and scalar values become '****'.

```php
use Spatie\HttpLogger\Sanitizer;

$sanitizer = new Sanitizer('****');
$headers   = [
    'Authorization' => ['Bearer abc123'],
    'Accept'        => ['application/json'],
    'Cookie'        => ['session=xyz'],
];

$clean = $sanitizer->clean($headers, ['authorization', 'cookie']);

// $clean === [
//   'Authorization' => ['****'],          // array value -> ['****']
//   'Accept'        => ['application/json'],
//   'Cookie'        => ['****'],
// ]
```

--------------------------------

### Custom writer subclass example

Source: https://github.com/spatie/laravel-http-logger/blob/main/_autodocs/api-reference/DefaultLogWriter.md

Example of subclassing DefaultLogWriter to customize the sanitizer mask. The RedactingLogWriter overrides getSanitizer() to create a Sanitizer with the mask '[[REDACTED]]'.

```php
use Spatie\HttpLogger\DefaultLogWriter;
use Spatie\HttpLogger\Sanitizer;

class RedactingLogWriter extends DefaultLogWriter
{
    protected function getSanitizer()
    {
        if (! $this->sanitizer instanceof Sanitizer) {
            $this->sanitizer = new Sanitizer('[[REDACTED]]');
        }

        return $this->sanitizer;
    }
}
```

--------------------------------

### Custom LogWriter using Sanitizer

Source: https://github.com/spatie/laravel-http-logger/blob/main/_autodocs/api-reference/Sanitizer.md

Example of a JsonLogWriter that uses Sanitizer to clean headers before logging. It reads the sanitize_headers config key and logs to the configured channel.

```php
use Illuminate\Http\Request;
use Spatie\HttpLogger\LogWriter;
use Spatie\HttpLogger\Sanitizer;
use Illuminate\Support\Facades\Log;

class JsonLogWriter implements LogWriter
{
    public function logRequest(Request $request)
    {
        $sanitized = (new Sanitizer('****'))->clean(
            $request->headers->all(),
            config('http-logger.sanitize_headers')
        );

        Log::channel(config('http-logger.log_channel'))->info(json_encode($sanitized));
    }
}
```

--------------------------------

### Usage inside a custom LogWriter

Source: https://github.com/spatie/laravel-http-logger/blob/main/_autodocs/api-reference/Sanitizer.md

Example of using the Sanitizer class directly within a custom LogWriter to clean headers before writing logs.

```APIDOC
## Usage inside a custom LogWriter

### Description
`Sanitizer` is a standalone utility; a custom writer can use it directly to clean headers before writing.

### Example
```php
use Illuminate\Http\Request;
use Spatie\HttpLogger\LogWriter;
use Spatie\HttpLogger\Sanitizer;
use Illuminate\Support\Facades\Log;

class JsonLogWriter implements LogWriter
{
    public function logRequest(Request $request)
    {
        $sanitized = (new Sanitizer('****'))->clean(
            $request->headers->all(),
            config('http-logger.sanitize_headers')
        );

        Log::channel(config('http-logger.log_channel'))->info(json_encode($sanitized));
    }
}
```

### Notes
See [types.md](../types.md) for the header value shape and [configuration.md](../configuration.md) for the `sanitize_headers` config key.
```

--------------------------------

### formatMessage() method signature

Source: https://github.com/spatie/laravel-http-logger/blob/main/_autodocs/api-reference/DefaultLogWriter.md

Protected method that serializes the message array into a log string. Returns a string in the format: "{method} {uri} - Body: {json_encode(body)} - Headers: {json_encode(headers)} - Files: {comma-separated file names}". Example output: POST /submit-form - Body: {"name":"Jane"} - Headers: {"host":["localhost"]} - Files: report.pdf,screenshot.png.

```php
protected function formatMessage(array $message)
```

--------------------------------

### Custom Log Writer Implementation

Source: https://github.com/spatie/laravel-http-logger/blob/main/README.md

Example implementation of the LogWriter interface's logRequest method, which writes the request to the log. It logs the method, URI, and body as JSON, excluding fields configured in 'except'.

```php
// Example implementation from `\Spatie\HttpLogger\DefaultLogWriter`

public function logRequest(Request $request): void
{
    $method = strtoupper($request->getMethod());
    
    $uri = $request->getPathInfo();
    
    $bodyAsJson = json_encode($request->except(config('http-logger.except')));

    $message = "{$method} {$uri} - {$bodyAsJson}";

    Log::channel(config('http-logger.log_channel'))->info($message);
}
```

--------------------------------

### DefaultLogWriter::getMessage() implementation

Source: https://github.com/spatie/laravel-http-logger/blob/main/_autodocs/types.md

Annotated source of the getMessage method that builds the log message array. It flattens uploaded files, uppercases the HTTP method, gets path info, excludes fields from http-logger.except, sanitizes headers, and returns the array.

```php
public function getMessage(Request $request)
{
    $files = (new Collection(iterator_to_array($request->files)))
        ->map([$this, 'flatFiles'])
        ->flatten();

    return [
        'method' => strtoupper($request->getMethod()),
        'uri' => $request->getPathInfo(),
        'body' => $request->except(config('http-logger.except')),
        'headers' => $this->getSanitizer()->clean($request->headers->all(), config('http-logger.sanitize_headers')),
        'files' => $files,
    ];
}
```

--------------------------------

### Using DefaultLogWriter with nested file arrays

Source: https://github.com/spatie/laravel-http-logger/blob/main/_autodocs/api-reference/DefaultLogWriter.md

Example showing how flatFiles() is used internally when logging a request with nested file arrays. The log line ends with '- Files: a.pdf,b.pdf' for files under the 'attachments' field.

```php
$writer = new DefaultLogWriter();

// Request with: files['attachments'] = [UploadedFile('a.pdf'), UploadedFile('b.pdf')]
$writer->logRequest($request);
// Line ends with: - Files: a.pdf,b.pdf
```

--------------------------------

### Sanitize Headers Configuration

Source: https://github.com/spatie/laravel-http-logger/blob/main/README.md

Add headers to the 'sanitize_headers' array in the config file to mask their values in logs. For example, the Authorization header will be logged as 'Authorization: "****"' instead of the actual token.

```php
// in config/http-logger.php

return [
    // ...
    
    'sanitize_headers' => [
        'Authorization'
    ],
];
```

--------------------------------

### boot() method source

Source: https://github.com/spatie/laravel-http-logger/blob/main/_autodocs/api-reference/HttpLoggerServiceProvider.md

The boot() method publishes the config file when running in console and registers LogProfile and LogWriter as singletons using the configured classes.

```php
public function boot()
{
    if ($this->app->runningInConsole()) {
        $this->publishes([
            __DIR__.'/../config/http-logger.php' => config_path('http-logger.php'),
        ], 'config');
    }

    $this->app->singleton(LogProfile::class, config('http-logger.log_profile'));
    $this->app->singleton(LogWriter::class, config('http-logger.log_writer'));
}
```

--------------------------------

### Basic usage of DefaultLogWriter

Source: https://github.com/spatie/laravel-http-logger/blob/main/_autodocs/api-reference/DefaultLogWriter.md

Shows how to instantiate DefaultLogWriter and log a request. The output demonstrates the log line format including method, URI, body, headers, and files.

```php
use Spatie\HttpLogger\DefaultLogWriter;
use Illuminate\Http\Request;

$writer = new DefaultLogWriter();
$writer->logRequest(Request::create('/submit-form', 'POST', ['name' => 'Jane']));

// Log output (channel + level from config):
// POST /submit-form - Body: {"name":"Jane"} - Headers: {"host":["localhost"],...} - Files:
```

--------------------------------

### Implementing a custom profile

Source: https://github.com/spatie/laravel-http-logger/blob/main/_autodocs/api-reference/LogNonGetRequests.md

Shows how to implement the LogProfile interface to create a custom logging profile and configure it via the http-logger.log_profile config key.

```APIDOC
## Implementing a custom profile

### Description
This class is meant as a reference implementation. To log by different rules, implement the `LogProfile` interface directly and point `http-logger.log_profile` at it.

### Example
```php
use Illuminate\Http\Request;
use Spatie\HttpLogger\LogProfile;

class LogAllRequestsExceptHealthChecks implements LogProfile
{
    public function shouldLogRequest(Request $request): bool
    {
        if ($request->is('health*')) {
            return false;
        }

        return true;
    }
}
```

### Configuration
```php
// config/http-logger.php
'log_profile' => \App\Http\Logging\LogAllRequestsExceptHealthChecks::class,
```

The middleware only ever talks to this class through the `LogProfile` interface (see HttpLogger), so any driver registered under `http-logger.log_profile` is interchangeable. See configuration.md for all keys.
```

--------------------------------

### Run Tests

Source: https://github.com/spatie/laravel-http-logger/blob/main/README.md

Run the package's test suite using Composer.

```bash
composer test
```

--------------------------------

### Instantiate Sanitizer with default and custom masks

Source: https://github.com/spatie/laravel-http-logger/blob/main/_autodocs/api-reference/Sanitizer.md

Shows basic usage: creating a Sanitizer with the default mask '****' and with a custom mask '[REDACTED]'.

```php
use Spatie\HttpLogger\Sanitizer;

$sanitizer = new Sanitizer();              // mask "****"
$custom    = new Sanitizer('[REDACTED]');  // custom mask
```

--------------------------------

### Swap custom log profile and writer implementations

Source: https://github.com/spatie/laravel-http-logger/blob/main/_autodocs/configuration.md

Replace the default profile and writer with custom classes that implement Spatie\HttpLogger\LogProfile and Spatie\HttpLogger\LogWriter respectively.

```php
// config/http-logger.php
return [
    'log_profile' => \App\Http\Logging\LogAllPostRequests::class, // implements Spatie\HttpLogger\LogProfile
    'log_writer'  => \App\Http\Logging\JsonLogWriter::class,      // implements Spatie\HttpLogger\LogWriter
];
```

--------------------------------

### handle(Request $request, Closure $next)

Source: https://github.com/spatie/laravel-http-logger/blob/main/_autodocs/api-reference/HttpLogger.md

The main middleware entry point that logs the incoming request if the configured log profile allows it, then delegates to the next middleware in the pipeline.

```APIDOC
## handle(Request $request, Closure $next)

### Description
Processes an incoming HTTP request, logging it if the configured log profile permits, then passes control to the next middleware or route handler.

### Method
Middleware handle method (invoked by Laravel's HTTP pipeline)

### Signature
```php
public function handle(Request $request, Closure $next)
```

### Parameters
- **$request** (Illuminate\Http\Request) - Required - The incoming HTTP request being processed.
- **$next** (Closure) - Required - The next middleware / route handler in the pipeline.

### Return Type
The response produced by `$next($request)` (typically `Illuminate\Http\Response` or `Symfony\Component\HttpFoundation\Response`). No declared return type in source; it returns whatever the rest of the pipeline returns.

### Behavior
Logging happens *before* the request reaches the application — the log entry reflects the incoming request data. If `shouldLogRequest()` returns `false`, the middleware is a pure pass-through and writes nothing. Requests are logged even if the downstream handler later fails (that is the package's stated purpose: an audit trail of critical user submissions).

### Registration Examples

#### Global middleware (Laravel >= 11)
In `bootstrap/app.php`:
```php
->withMiddleware(function (Middleware $middleware) {
    $middleware->append(\Spatie\HttpLogger\Middlewares\HttpLogger::class);
})
```

#### Global middleware (Laravel <= 10)
In `app/Http/Kernel.php`:
```php
protected $middleware = [
    // ...
    \Spatie\HttpLogger\Middlewares\HttpLogger::class,
];
```

#### Single route (all Laravel versions)
```php
use Spatie\HttpLogger\Middlewares\HttpLogger;

Route::post('/submit-form', function () {
    // ...
})->middleware(HttpLogger::class);
```

#### Group / alias registration
```php
Route::middleware(HttpLogger::class)->group(function () {
    Route::post('/leads', [LeadController::class, 'store']);
});
```

### Customizing Behavior
Because the middleware delegates to the container-resolved singletons, swapping the behavior is configuration only — the class itself is never touched:

```php
// config/http-logger.php
return [
    'log_profile' => \App\Http\Logging\MyProfile::class, // must implement Spatie\HttpLogger\LogProfile
    'log_writer'  => \App\Http\Logging\MyWriter::class,   // must implement Spatie\HttpLogger\LogWriter
];
```

### Error Handling
There is no error handling inside the middleware: it contains no `try`/`catch` and throws nothing itself. Exceptions raised by `shouldLogRequest()` or `logRequest()` propagate up the pipeline and are handled by the application's exception handler like any other middleware failure. The package defines no custom error classes (there are no `throw` statements anywhere in `src/`), so no error reference page is generated.
```

--------------------------------

### Configuring the custom log profile

Source: https://github.com/spatie/laravel-http-logger/blob/main/_autodocs/api-reference/LogNonGetRequests.md

Configuration snippet showing how to set the 'log_profile' key in config/http-logger.php to use the custom profile class.

```php
// config/http-logger.php
'log_profile' => \App\Http\Logging\LogAllRequestsExceptHealthChecks::class,
```

--------------------------------

### Customize behavior via config

Source: https://github.com/spatie/laravel-http-logger/blob/main/_autodocs/api-reference/HttpLogger.md

Swap the log profile and log writer implementations via the config/http-logger.php file. The classes must implement the respective interfaces.

```php
// config/http-logger.php
return [
    'log_profile' => \App\Http\Logging\MyProfile::class, // must implement Spatie\HttpLogger\LogProfile
    'log_writer'  => \App\Http\Logging\MyWriter::class,   // must implement Spatie\HttpLogger\LogWriter
];
```

--------------------------------

### register() method source

Source: https://github.com/spatie/laravel-http-logger/blob/main/_autodocs/api-reference/HttpLoggerServiceProvider.md

The register() method merges the package config file into the application config under the 'http-logger' key.

```php
public function register()
{
    $this->mergeConfigFrom(__DIR__.'/../config/http-logger.php', 'http-logger');
}
```

--------------------------------

### Override configuration at runtime with config()

Source: https://github.com/spatie/laravel-http-logger/blob/main/_autodocs/configuration.md

Use config() to override settings at runtime, e.g., in tests or maintenance toggles. Overrides take effect immediately for any class, including middleware resolved earlier, because the profile/writer singletons are built lazily on first use.

```php
config(['http-logger.log_level' => 'warning']);
config(['http-logger.sanitize_headers' => array_merge(
    config('http-logger.sanitize_headers'),
    ['X-Internal-Token']
)]);
```

--------------------------------

### Artisan vendor:publish command for config

Source: https://github.com/spatie/laravel-http-logger/blob/main/_autodocs/api-reference/HttpLoggerServiceProvider.md

Command to publish the package config file to the application's config directory under the 'config' tag.

```bash
php artisan vendor:publish --provider="Spatie\HttpLogger\HttpLoggerServiceProvider" --tag="config"
```

--------------------------------

### Constructor: __construct(string $mask = "****")

Source: https://github.com/spatie/laravel-http-logger/blob/main/_autodocs/api-reference/Sanitizer.md

Creates a new Sanitizer instance with an optional mask string used to replace sensitive values.

```APIDOC
## Constructor: __construct(string $mask = "****")

### Description
Creates a new Sanitizer instance with an optional mask string used to replace sensitive values.

### Method
Constructor

### Signature
```php
public function __construct(string $mask = "****")
```

### Parameters
- **$mask** (string) - Optional - The replacement string substituted for sanitized values. Defaults to "****".

### Example
```php
use Spatie\HttpLogger\Sanitizer;

$sanitizer = new Sanitizer();              // mask "****"
$custom    = new Sanitizer('[REDACTED]');  // custom mask
```
```

--------------------------------

### Published Config File

Source: https://github.com/spatie/laravel-http-logger/blob/main/README.md

The default configuration file for the package. It includes options for enabling logging, setting the log profile and writer, log channel, log level, excluding body fields, and sanitizing headers.

```php
return [

    /*
     * Determine if the http-logger middleware should be enabled.
     */
    'enabled' => env('HTTP_LOGGER_ENABLED', true),

    /*
     * The log profile which determines whether a request should be logged.
     * It should implement `LogProfile`.
     */
    'log_profile' => \Spatie\HttpLogger\LogNonGetRequests::class,

    /*
     * The log writer used to write the request to a log.
     * It should implement `LogWriter`.
     */
    'log_writer' => \Spatie\HttpLogger\DefaultLogWriter::class,
    
    /*
     * The log channel used to write the request.
     */
    'log_channel' => env('LOG_CHANNEL', 'stack'),
    
    /*
     * The log level used to log the request.
     */
    'log_level' => 'info',
    
    /*
     * Filter out body fields which will never be logged.
     */
    'except' => [
        'password',
        'password_confirmation',
    ],
    
    /*
     * List of headers that will be sanitized. For example Authorization, Cookie, Set-Cookie...
     */
    'sanitize_headers' => [],
];
```

--------------------------------

### Configure channel, level, and header sanitization in config/http-logger.php

Source: https://github.com/spatie/laravel-http-logger/blob/main/_autodocs/configuration.md

This configuration routes logs to the 'http' channel at 'debug' level, uses the default profile and writer, excludes sensitive fields, and sanitizes Authorization, Cookie, and Set-Cookie headers. The output for a request with 'Authorization: Bearer {token}' becomes '"authorization":["****"]' instead of the raw token.

```php
// config/http-logger.php
return [
    'enabled'         => env('HTTP_LOGGER_ENABLED', true),
    'log_profile'     => \Spatie\HttpLogger\LogNonGetRequests::class,
    'log_writer'      => \Spatie\HttpLogger\DefaultLogWriter::class,
    'log_channel'     => 'http',
    'log_level'       => 'debug',
    'except'          => ['password', 'password_confirmation', 'csrf_token'],
    'sanitize_headers' => ['Authorization', 'Cookie', 'Set-Cookie'],
];
```

--------------------------------

### Register in a route group

Source: https://github.com/spatie/laravel-http-logger/blob/main/_autodocs/api-reference/HttpLogger.md

Apply the HttpLogger middleware to a group of routes using the group() method with the middleware() method.

```php
Route::middleware(HttpLogger::class)->group(function () {
    Route::post('/leads', [LeadController::class, 'store']);
});
```

--------------------------------

### handle() method signature

Source: https://github.com/spatie/laravel-http-logger/blob/main/_autodocs/api-reference/HttpLogger.md

Signature of the handle() method declared at src/Middlewares/HttpLogger.php:22. It accepts the incoming request and the next middleware closure, returning the pipeline's response.

```php
public function handle(Request $request, Closure $next)
```

--------------------------------

### handle() method body

Source: https://github.com/spatie/laravel-http-logger/blob/main/_autodocs/api-reference/HttpLogger.md

Body of the handle() method. Logs the request if shouldLogRequest() returns true, then passes the request to the next middleware. If shouldLogRequest() returns false, it acts as a pure pass-through.

```php
if ($this->logProfile->shouldLogRequest($request)) {
    $this->logWriter->logRequest($request);
}

return $next($request);
```

--------------------------------

### Register Middleware for Laravel >= 11

Source: https://github.com/spatie/laravel-http-logger/blob/main/README.md

Append the HttpLogger middleware globally in Laravel 11 and above using the withMiddleware method.

```php
->withMiddleware(function (Middleware $middleware) {
    $middleware->append(\Spatie\HttpLogger\Middlewares\HttpLogger::class);
})
```

--------------------------------

### logRequest(Request $request)

Source: https://github.com/spatie/laravel-http-logger/blob/main/_autodocs/api-reference/DefaultLogWriter.md

Logs an incoming HTTP request by formatting it into a single line and writing it to the configured log channel and level.

```APIDOC
## logRequest(Request $request)

### Description
Logs an incoming HTTP request by serializing its method, URI, body (minus excluded fields), sanitized headers, and uploaded file names into a single human-readable line, then writes it through Laravel's Log facade to the configured channel at the configured level.

### Method
logRequest

### Endpoint
N/A - This is a PHP method, not an HTTP endpoint.

### Parameters
- **$request** (Illuminate\Http\Request) - Required - The request to log.

### Request Example
```php
use Spatie\HttpLogger\DefaultLogWriter;
use Illuminate\Http\Request;

$writer = new DefaultLogWriter();
$writer->logRequest(Request::create('/submit-form', 'POST', ['name' => 'Jane']));
```

### Response
#### Success Response
No return value (implicit null).

#### Response Example
Log output (channel + level from config):
```
POST /submit-form - Body: {"name":"Jane"} - Headers: {"host":["localhost"],...} - Files:
```

### Notes
- The log channel is determined by `config('http-logger.log_channel')` (default `env('LOG_CHANNEL', 'stack')`).
- The log level is determined by `config('http-logger.log_level', 'info')`.
- Body fields listed in `http-logger.except` (e.g., `password`) are stripped before serialization.

```

--------------------------------

### Apply Middleware to a Route

Source: https://github.com/spatie/laravel-http-logger/blob/main/README.md

Apply the HttpLogger middleware to a specific route using the middleware method.

```php
// in a routes file

Route::post('/submit-form', function () {
    //
})->middleware(\Spatie\HttpLogger\Middlewares\HttpLogger::class);
```

--------------------------------

### Register Middleware for Laravel <= 10

Source: https://github.com/spatie/laravel-http-logger/blob/main/README.md

Add the HttpLogger middleware to the global middleware stack in app/Http/Kernel.php for Laravel 10 and below.

```php
// in `app/Http/Kernel.php`

protected $middleware = [
    // ...
    
    \Spatie\HttpLogger\Middlewares\HttpLogger::class
];
```

--------------------------------

### Empty key list disables sanitization

Source: https://github.com/spatie/laravel-http-logger/blob/main/_autodocs/api-reference/Sanitizer.md

Edge case: passing an empty key list returns the input unchanged.

```php
$same = $sanitizer->clean($headers, []); // returns $headers unchanged
```

--------------------------------

### normalize() method signature

Source: https://github.com/spatie/laravel-http-logger/blob/main/_autodocs/api-reference/Sanitizer.md

Declared at src/Sanitizer.php:41. Returns strtolower($string) for case-insensitive matching. All keys passed to clean() must be string-convertible because normalize() is applied to every input key.

```php
public function normalize(string $string)
```

--------------------------------

### flatFiles() method signature

Source: https://github.com/spatie/laravel-http-logger/blob/main/_autodocs/api-reference/DefaultLogWriter.md

Public method that recursively reduces upload entries to strings. For UploadedFile returns the client original name, for arrays recurses, and for anything else casts to string. Used as the mapper for the files collection to log filenames.

```php
public function flatFiles($file)
```

--------------------------------

### getMessage(Request $request)

Source: https://github.com/spatie/laravel-http-logger/blob/main/_autodocs/api-reference/DefaultLogWriter.md

Returns an array containing the HTTP method, URI, body, headers, and files from the given request. The body excludes fields configured in 'http-logger.except', and headers are sanitized according to 'http-logger.sanitize_headers'.

```APIDOC
## getMessage(Request $request)

### Description
Returns a structured array containing the HTTP method, URI, body, headers, and files from the given request. The body excludes fields configured in 'http-logger.except', and headers are sanitized according to 'http-logger.sanitize_headers'.

### Method
PHP method

### Signature
`public function getMessage(Request $request)`

### Parameters
- **$request** (Illuminate\Http\Request) - Required - The request to analyze.

### Return Type
`array` with the following keys:

| Key       | Type                            | Description |
|-----------|---------------------------------|-------------|
| `method`  | `string`                        | Uppercased HTTP method, from `$request->getMethod()`. |
| `uri`     | `string`                        | Path info, from `$request->getPathInfo()` (no base URL, no query string). |
| `body`    | `array`                         | `$request->except(config('http-logger.except'))` — all body input minus excluded fields. |
| `headers` | `array`                         | `$this->getSanitizer()->clean($request->headers->all(), config('http-logger.sanitize_headers'))` — header map (values are arrays) with configured headers replaced by the mask. |
| `files`   | `Illuminate\Support\Collection` | Flattened list of uploaded file names; see `flatFiles()`. |

### Behavior
Uploaded files are collected with `(new Collection(iterator_to_array($request->files)))->map([$this, 'flatFiles'])->flatten()` — every `UploadedFile` (including files nested inside arrays) is reduced to its client-side original name. The resulting collection is stored under `files`.

### Example
```php
$writer = new DefaultLogWriter();
$message = $writer->getMessage(Request::create('/api/orders', 'PUT', ['qty' => 3]));
// $message['method'] === 'PUT'
// $message['uri']    === '/api/orders'
// $message['body']   === ['qty' => 3]
```
```

--------------------------------

### normalize(string $string)

Source: https://github.com/spatie/laravel-http-logger/blob/main/_autodocs/api-reference/Sanitizer.md

Normalizes a header/key name to lowercase for case-insensitive matching. Returns the lowercased string.

```APIDOC
## normalize(string $string)

### Description
Normalizes a header/key name to lowercase for case-insensitive matching. Returns the lowercased string.

### Method
normalize

### Signature
```php
public function normalize(string $string)
```

### Parameters
- `$string` (string) - Required - Header/key name to normalize.

### Return Type
`string` — `strtolower($string)`. Used to achieve case-insensitive matching for both the keys to sanitize and the input keys. Because `clean()` applies `normalize()` to every input key, all keys passed to `clean()` must be string-convertible; non-string keys would trigger PHP's type coercion rules for the declared `string` parameter.
```

--------------------------------

### Register on a single route

Source: https://github.com/spatie/laravel-http-logger/blob/main/_autodocs/api-reference/HttpLogger.md

Attach the HttpLogger middleware to a single route using the middleware() method. Works in all Laravel versions.

```php
use Spatie\HttpLogger\Middlewares\HttpLogger;

Route::post('/submit-form', function () {
    // ...
})->middleware(HttpLogger::class);
```

--------------------------------

### Register AuditLogWriter in config

Source: https://github.com/spatie/laravel-http-logger/blob/main/_autodocs/api-reference/LogWriter.md

Configuration snippet showing how to bind the custom writer class to the 'log_writer' key in config/http-logger.php.

```php
// config/http-logger.php
'log_writer' => \App\Http\Logging\AuditLogWriter::class,
```

--------------------------------

### HttpLogger constructor signature

Source: https://github.com/spatie/laravel-http-logger/blob/main/_autodocs/api-reference/HttpLogger.md

Declared at src/Middlewares/HttpLogger.php:16. Accepts a LogProfile and a LogWriter, both typed against their interfaces. Laravel resolves these from the http-logger.log_profile and http-logger.log_writer config bindings.

```php
public function __construct(LogProfile $logProfile, LogWriter $logWriter)
```

--------------------------------

### Sanitizer constructor signature

Source: https://github.com/spatie/laravel-http-logger/blob/main/_autodocs/api-reference/Sanitizer.md

Declared at src/Sanitizer.php:9. The constructor accepts an optional mask string, defaulting to '****'.

```php
public function __construct(string $mask = "****")
```

--------------------------------

### getSanitizer() method signature

Source: https://github.com/spatie/laravel-http-logger/blob/main/_autodocs/api-reference/DefaultLogWriter.md

The protected method signature for getSanitizer() as declared in DefaultLogWriter. It returns a Sanitizer instance.

```php
protected function getSanitizer()
```

--------------------------------

### getSanitizer() implementation body

Source: https://github.com/spatie/laravel-http-logger/blob/main/_autodocs/api-reference/DefaultLogWriter.md

The body of the getSanitizer() method that lazily creates and caches a Sanitizer instance. The instance is created with the default mask "****" on first use and reused for the lifetime of the writer.

```php
if (! $this->sanitizer instanceof Sanitizer) {
    $this->sanitizer = new Sanitizer();
}

return $this->sanitizer;
```

--------------------------------

### Default published configuration file for laravel-http-logger

Source: https://github.com/spatie/laravel-http-logger/blob/main/_autodocs/configuration.md

This is the default configuration file published by the package. It defines the middleware enabled flag, the log profile and writer classes, the log channel, log level, and filters for sensitive body fields and headers. The 'enabled' option uses the HTTP_LOGGER_ENABLED environment variable (default true) and 'log_channel' uses LOG_CHANNEL (default 'stack').

```php
<?php

return [

    /*
     * Determine if the http-logger middleware should be enabled.
     */
    'enabled' => env('HTTP_LOGGER_ENABLED', true),

    /*
     * The log profile which determines whether a request should be logged.
     * It should implement `LogProfile`.
     */
    'log_profile' => \Spatie\HttpLogger\LogNonGetRequests::class,

    /*
     * The log writer used to write the request to a log.
     * It should implement `LogWriter`.
     */
    'log_writer' => \Spatie\HttpLogger\DefaultLogWriter::class,

    /*
     * The log channel used to write the request.
     */
    'log_channel' => env('LOG_CHANNEL', 'stack'),

    /*
     * The log level used to log the request.
     */
    'log_level' => 'info',

    /*
     * Filter out body fields which will never be logged.
     */
    'except' => [
        'password',
        'password_confirmation',
    ],

    /*
     * List of headers that will be sanitized. For example Authorization, Cookie, Set-Cookie...
     */
    'sanitize_headers' => [],
];
```

--------------------------------

### Sanitizer clean() method signature

Source: https://github.com/spatie/laravel-http-logger/blob/main/_autodocs/api-reference/Sanitizer.md

Declared at src/Sanitizer.php:14. Accepts an input array and keys to redact, returning a sanitized copy.

```php
public function clean(array $input, $keys)
```

--------------------------------

### Excluded fields are stripped from log output

Source: https://github.com/spatie/laravel-http-logger/blob/main/_autodocs/api-reference/DefaultLogWriter.md

Demonstrates that body fields listed in http-logger.except (e.g., password) are removed before serialization. The comment shows the resulting log line contains only the non-excluded fields.

```php
// config('http-logger.except') = ['password', 'password_confirmation']

$writer->logRequest(Request::create('/login', 'POST', [
    'email' => 'jane@example.com',
    'password' => 'secret',
]));

// Line contains: {"email":"jane@example.com"}       <- "password" absent
```

--------------------------------

### Register as global middleware in Laravel <= 10

Source: https://github.com/spatie/laravel-http-logger/blob/main/_autodocs/api-reference/HttpLogger.md

Register the HttpLogger middleware globally in app/Http/Kernel.php for Laravel 10 and below by adding it to the $middleware property.

```php
protected $middleware = [
    // ...
    \Spatie\HttpLogger\Middlewares\HttpLogger::class,
];
```

--------------------------------

### shouldLogRequest()

Source: https://github.com/spatie/laravel-http-logger/blob/main/_autodocs/api-reference/LogNonGetRequests.md

Determines whether an incoming request should be logged. Returns true only if logging is enabled and the request method is one of POST, PUT, PATCH, DELETE, or QUERY.

```APIDOC
## shouldLogRequest()

### Description
Determines whether an incoming request should be logged. Returns `true` only if logging is enabled and the request method is one of `post`, `put`, `patch`, `delete`, or `query`.

### Method
`shouldLogRequest(Request $request): bool`

### Parameters
- **$request** (Illuminate\Http\Request) - Required - The incoming request to evaluate.

### Return Type
`bool` - `true` if the request should be logged, `false` otherwise.

### Behavior
Two independent conditions, both must pass:
1. **Enabled flag:** `config('http-logger.enabled')` must be truthy. The shipped config sets it from the `HTTP_LOGGER_ENABLED` environment variable (default `true`). When falsy, no request is logged regardless of method.
2. **HTTP method:** the lowercase request method must be one of `post`, `put`, `patch`, `delete`, `query`. `query` corresponds to the QUERY HTTP method (added in v1.12.0), which — like POST — carries parameters in the request body. `get`, `head`, `options`, `trace`, and `connect` are never logged.

Note that the method check uses `$request->method()`, which reflects the actual request method (including overridden methods via `_method`, since that is how Laravel's `method()` resolves it).

### Example
```php
use Spatie\HttpLogger\LogNonGetRequests;
use Illuminate\Http\Request;

$profile = new LogNonGetRequests();

var_dump($profile->shouldLogRequest(Request::create('/form', 'POST')));   // bool(true)
var_dump($profile->shouldLogRequest(Request::create('/form', 'GET')));    // bool(false)
var_dump($profile->shouldLogRequest(Request::create('/api', 'QUERY')));   // bool(true)
```

### Example with enabled flag
```php
use Spatie\HttpLogger\LogNonGetRequests;
use Illuminate\Http\Request;

$profile = new LogNonGetRequests();
$request = Request::create('/lead', 'POST');

config(['http-logger.enabled' => true]);
var_dump($profile->shouldLogRequest($request)); // bool(true)

config(['http-logger.enabled' => false]);
var_dump($profile->shouldLogRequest($request)); // bool(false) even though method is POST
```
```

--------------------------------

### Sanitizer clean() method body

Source: https://github.com/spatie/laravel-http-logger/blob/main/_autodocs/api-reference/Sanitizer.md

Source body of clean() at src/Sanitizer.php:14. Recursively replaces values of matching keys with the mask, preserving key casing.

```php
$keys = (array) $keys;

if (count($keys) === 0) {
    return $input;
}

$keys = array_map([$this, 'normalize'], $keys);

foreach ($input as $key => $value) {
    $normalizedKey = $this->normalize($key);

    if (in_array($normalizedKey, $keys)) {
        $input[$key] = is_array($value) ? [$this->mask] : $this->mask;

        continue;
    }

    if (is_array($value)) {
        $input[$key] = $this->clean($value, $keys);
    }
}

return $input;
```

--------------------------------

### setMask() method signature

Source: https://github.com/spatie/laravel-http-logger/blob/main/_autodocs/api-reference/Sanitizer.md

Declared at src/Sanitizer.php:46. Replaces the mask used by subsequent clean() calls. Return type is implicitly null.

```php
public function setMask(string $mask)
```

--------------------------------

### LogProfile interface definition

Source: https://github.com/spatie/laravel-http-logger/blob/main/_autodocs/api-reference/LogProfile.md

The interface declares a single method shouldLogRequest(Request $request): bool. Implementations must provide this method to determine if a request should be logged.

```php
interface LogProfile
{
    public function shouldLogRequest(Request $request): bool;
}
```

--------------------------------

### shouldLogRequest() method signature

Source: https://github.com/spatie/laravel-http-logger/blob/main/_autodocs/api-reference/LogProfile.md

The method signature for shouldLogRequest. It takes an Illuminate\Http\Request and returns a boolean. The method is called before the request proceeds to the application and must be deterministic.

```php
public function shouldLogRequest(Request $request): bool
```

--------------------------------

### setMask(string $mask)

Source: https://github.com/spatie/laravel-http-logger/blob/main/_autodocs/api-reference/Sanitizer.md

Replaces the mask used by subsequent clean() calls. Accepts a new replacement string.

```APIDOC
## setMask(string $mask)

### Description
Replaces the mask used by subsequent `clean()` calls. Accepts a new replacement string.

### Method
setMask

### Signature
```php
public function setMask(string $mask)
```

### Parameters
- `$mask` (string) - Required - New replacement string.

### Return Type
none declared (implicit `null`).

### Example
```php
use Spatie\HttpLogger\Sanitizer;

$sanitizer  = new Sanitizer();
$redactAll  = ['x-api-key' => ['sk-live-123']];

$first = $sanitizer->clean($redactAll, ['x-api-key']);
// ['x-api-key' => ['****']]

$sanitizer->setMask('###');
$second = $sanitizer->clean($redactAll, ['x-api-key']);
// ['x-api-key' => ['###']]
```
```

--------------------------------

### shouldLogRequest(Request $request): bool

Source: https://github.com/spatie/laravel-http-logger/blob/main/_autodocs/api-reference/LogProfile.md

Determines whether the given request should be logged. This method is called by the HttpLogger middleware before the request proceeds to the application. It must be side-effect free and deterministic for the given request. Returns true to log the request, false to skip it.

```APIDOC
## shouldLogRequest(Request $request): bool

### Description
Determines whether the given request should be logged. This method is called by the HttpLogger middleware before the request proceeds to the application. It must be side-effect free and deterministic for the given request. Returns true to log the request, false to skip it.

### Method
shouldLogRequest

### Endpoint
N/A - This is a PHP interface method, not an HTTP endpoint.

### Parameters
- **$request** (Illuminate\Http\Request) - Required - The incoming request being evaluated for logging.

### Return Type
bool - true to log the request, false to skip it.

### Contract Semantics
This method is invoked by the middleware *before* the request proceeds to the application; it must be side-effect free in the sense that the decision must be deterministic for the given request. If it returns true, the configured LogWriter is called with the same request. If it returns false, the request passes through unlogged.

### Usage Example
```php
use Illuminate\Http\Request;
use Spatie\HttpLogger\LogProfile;

class LogOnlyStoreRoutes implements LogProfile
{
    public function shouldLogRequest(Request $request): bool
    {
        return $request->isMethod('POST')
            && str_starts_with($request->path(), 'store');
    }
}
```

### Registration Example
```php
// config/http-logger.php
'log_profile' => \App\Http\Logging\LogOnlyStoreRoutes::class,
```

### Dependency Injection
Because the middleware receives the profile via constructor injection, a profile may declare its own constructor dependencies and they will be resolved by the container when the singleton is built:

```php
use Illuminate\Http\Request;
use Spatie\HttpLogger\LogProfile;

class LogForTenant implements LogProfile
{
    public function __construct(private TenantResolver $tenants)
    {
    }

    public function shouldLogRequest(Request $request): bool
    {
        return $this->tenants->current() !== null;
    }
}
```
```

--------------------------------

### shouldLogRequest method body

Source: https://github.com/spatie/laravel-http-logger/blob/main/_autodocs/api-reference/LogNonGetRequests.md

Source body of shouldLogRequest. It checks the 'http-logger.enabled' config and the HTTP method (post, put, patch, delete, query).

```php
if (! config('http-logger.enabled')) {
    return false;
}

return in_array(strtolower($request->method()), ['post', 'put', 'patch', 'delete', 'query']);
```

--------------------------------

### Spatie\HttpLogger\LogProfile::shouldLogRequest

Source: https://github.com/spatie/laravel-http-logger/blob/main/_autodocs/types.md

Interface method that determines whether a request should be logged. Implemented by LogNonGetRequests and called by the HttpLogger middleware.

```APIDOC
## LogProfile::shouldLogRequest

### Description
Returns true when the request should be logged.

### Method
shouldLogRequest

### Signature
```php
public function shouldLogRequest(Request $request): bool
```

### Parameters
- **$request** (Illuminate\Http\Request) - Required - The incoming HTTP request.

### Return Value
- **bool** - True if the request should be logged, false otherwise.

### Usage Notes
- Implemented by: Spatie\HttpLogger\LogNonGetRequests (default).
- Called by: Spatie\HttpLogger\Middlewares\HttpLogger::handle().
- Configured via: http-logger.log_profile.
```

--------------------------------

### logRequest() method signature

Source: https://github.com/spatie/laravel-http-logger/blob/main/_autodocs/api-reference/LogWriter.md

The method signature for logRequest() as declared in the interface. It takes an Illuminate\Http\Request object and has no declared return type.

```php
public function logRequest(Request $request)
```

--------------------------------

### Disable logging via HTTP_LOGGER_ENABLED env variable

Source: https://github.com/spatie/laravel-http-logger/blob/main/_autodocs/configuration.md

Set HTTP_LOGGER_ENABLED=false in your .env file to disable logging entirely.

```dotenv
HTTP_LOGGER_ENABLED=false
```

--------------------------------

### LogProfile interface definition

Source: https://github.com/spatie/laravel-http-logger/blob/main/_autodocs/types.md

Defines the contract for deciding whether a request should be logged. Implemented by LogNonGetRequests and consumed by HttpLogger::handle().

```php
namespace Spatie\HttpLogger;

use Illuminate\Http\Request;

interface LogProfile
{
    public function shouldLogRequest(Request $request): bool;
}
```
Tokens:
Raw