People searching “Laravel log Vue error” write Log::debug($request->all()) in the login controller. The password lands in storage/logs. Log the fact, not the secret. The Fortify guide is the login. This page is the line you add when it fails.
TL;DR
- Log the user id and the failure.
- Do not log the request body, the token, or the password.
- Do not log the CSRF token, the session id, or
Authorization. - Do not send log lines to the Inertia page so an admin can read them in Vue.
The fix#
Log::warning('login failed', [
'email' => $request->string('email')->toString(),
'ip' => $request->ip(),
]);LOG_STACK=daily rotates the file. single is one growing file. Neither choice makes a password acceptable.
A Vue onError can show “Could not sign in”. It should not console.log the form, for the same reason. The browser console is not private on a shared machine.
What to avoid#
Gotcha
Do not log the CSRF token, the session id, or Authorization. Do not send log lines to the Inertia page so an admin can read them in Vue. That is how a log viewer becomes a data leak. Telescope, local only, is the debugging tool.
FAQ#
How do I log a failure without the password?
Log the user id and the failure. Do not log the request body, the token, or the password.
What goes wrong with Laravel log Vue error?
Many developers write Log::debug($request->all()) in the login controller. Do not log the CSRF token, the session id, or Authorization.
