A Laravel middleware package from Spatie that logs incoming HTTP request data to the application's default log, built for teams that need a safety net when a critical user submission fails partway through. It is for Laravel developers and platform teams running lead-generation forms, checkout flows, or any endpoint where losing the original request body would mean losing the customer.

What it is

spatie/laravel-http-logger is a PHP package published on Packagist that registers a middleware class, Spatie\HttpLogger\Middlewares\HttpLogger, into a Laravel application. Once the middleware is active, it inspects each incoming request and writes the request data to the application's configured log channel. The package belongs to the Laravel ecosystem and is released under the MIT licence, with topics covering http, laravel, logging, and php.

The concrete problem it solves is data loss on failed requests. If anything goes wrong during a user's request, the developer can still access the original request data that the user sent. That matters most for critical user submissions such as forms that generate leads, where the request body is the only record of what the visitor typed and where a crash in a downstream handler would otherwise discard it. It replaces ad-hoc debugging approaches, such as temporarily dumping request payloads into a controller or routing request data through a general-purpose logging library by hand, by giving the application one middleware and one config file to control the whole behaviour.

Key capabilities

• Intercepts requests through a Laravel middleware, registerable either as global middleware or on a single route.
• Logs only POST, PUT, PATCH, DELETE, and QUERY requests by default through the bundled Spatie\HttpLogger\LogNonGetRequests profile.
• Routes output through a configurable log channel, defaulting to the Laravel stack channel set via LOG_CHANNEL, at level info.
• Excludes sensitive body fields by default, shipping with password and password_confirmation in the except array.
• Sanitizes a configurable list of headers through the sanitize_headers setting, intended for headers such as Authorization, Cookie, and Set-Cookie.
• Allows a custom profile by implementing the LogProfile interface with a shouldLogRequest method, letting a team decide exactly which requests deserve a log entry.
• Allows a custom writer by implementing the LogWriter interface with a logRequest method, so request data can be sent somewhere other than the default Laravel logger.
• Toggles on and off per environment through the HTTP_LOGGER_ENABLED variable in the .env file.

Who uses it and how

• Teams running lead-generation forms that need the submitted payload recoverable after a downstream failure.
• Laravel applications that already centralize logging on the stack channel and want request bodies to land in the same pipeline as application errors.
• Projects on Laravel 11 or newer, which register the middleware through the ->withMiddleware() callback in bootstrap/app.php.
• Applications that need selective capture, using a custom LogProfile to log payment or signup endpoints while ignoring the rest of the traffic.
• Teams with a compliance or storage constraint on where logs live, who override the default LogWriter to push request data somewhere other than the default log.

Getting started

Install with composer require spatie/laravel-http-logger, then optionally publish the configuration with php artisan vendor:publish --provider="Spatie\HttpLogger\HttpLoggerServiceProvider" --tag="config" and register the middleware. There is no hosted option and no Docker image; the package is consumed as a Composer dependency inside an existing Laravel application.

How it compares

The facts do not list any paid products this package replaces, and they name no comparable sibling tool, so on the evidence provided it stands alone in this registry.

When to use it — and when not to

A self-hoster must operate the full Laravel logging stack this package writes into: the application's configured log channel, its storage, and whatever log shipping sits behind it. Anyone expecting database-backed request history, a query interface, or audit-grade retention should not pick it, because it writes to the Laravel log and nothing else. The most important limitation is visible in the config: sanitize_headers defaults to an empty array, so Authorization, Cookie, and Set-Cookie headers are not sanitized until a team explicitly lists them, and the body redaction list covers only password and password_confirmation out of the box. The README excerpt provided is also truncated mid-code-block, so details of the DefaultLogWriter implementation are not fully documented in the source material available here.

composer require spatie/laravel-http-logger

php artisan vendor:publish --provider="Spatie\HttpLogger\HttpLoggerServiceProvider" --tag="config" 

return [

    /*
     * Determine if the http-logger middleware should be enabled.
     */
    'enabled' => env('HTTP_LOGGER_ENABLED', true),

    /*
     * The log profile which determines whether a request should be logged.
     * It should implement `LogProfile`.
     */
    'log_profile' => \Spatie\HttpLogger\LogNonGetRequests::class,

    /*
     * The log writer used to write the request to a log.
     * It should implement `LogWriter`.
     */
    'log_writer' => \Spatie\HttpLogger\DefaultLogWriter::class,
    
    /*
     * The log channel used to write the request.
     */
    'log_channel' => env('LOG_CHANNEL', 'stack'),
    
    /*
     * The log level used to log the request.
     */
    'log_level' => 'info',
    
    /*
     * Filter out body fields which will never be logged.
     */
    'except' => [
        'password',
        'password_confirmation',
    ],
    
    /*
     * List of headers that will be sanitized. For example Authorization, Cookie, Set-Cookie...
     */
    'sanitize_headers' => [],
];

->withMiddleware(function (Middleware $middleware) {
    $middleware->append(\Spatie\HttpLogger\Middlewares\HttpLogger::class);
})

// in `app/Http/Kernel.php`

protected $middleware = [
    // ...
    
    \Spatie\HttpLogger\Middlewares\HttpLogger::class
];

// in a routes file

Route::post('/submit-form', function () {
    //
})->middleware(\Spatie\HttpLogger\Middlewares\HttpLogger::class);

// Example implementation from `\Spatie\HttpLogger\LogNonGetRequests`

public function shouldLogRequest(Request $request): bool
{
   return in_array(strtolower($request->method()), ['post', 'put', 'patch', 'delete', 'query']);
}

// Example implementation from `\Spatie\HttpLogger\DefaultLogWriter`

public function logRequest(Request $request): void
{
    $method = strtoupper($request->getMethod());
    
    $uri = $request->getPathInfo();
    
    $bodyAsJson = json_encode($request->except(config('http-logger.except')));

    $message = "{$method} {$uri} - {$bodyAsJson}";

    Log::channel(config('http-logger.log_channel'))->info($message);
}

// in config/http-logger.php

return [
    // ...
    
    'sanitize_headers' => [
        'Authorization'
    ],
];

composer test