PHPackages                             alajusticia/laravel-auth-tracker - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [Authentication & Authorization](/categories/authentication)
4. /
5. alajusticia/laravel-auth-tracker

AbandonedArchivedLibrary[Authentication & Authorization](/categories/authentication)

alajusticia/laravel-auth-tracker
================================

Track and manage sessions, Passport tokens and Sanctum tokens in Laravel.

v2.1.2(4y ago)2616.0k↓21.4%5MITPHPPHP ^7.2.5|^8.0

Since Oct 19Pushed 2y ago1 watchersCompare

[ Source](https://github.com/alajusticia/laravel-auth-tracker)[ Packagist](https://packagist.org/packages/alajusticia/laravel-auth-tracker)[ RSS](/packages/alajusticia-laravel-auth-tracker/feed)WikiDiscussions master Synced 2d ago

READMEChangelog (8)Dependencies (8)Versions (17)Used By (0)

Laravel Auth Tracker
====================

[](#laravel-auth-tracker)

> ⚠️ This package is now archived. Use [Laravel Logins](https://github.com/alajusticia/laravel-logins) instead.

#### Track and manage sessions, Passport tokens and Sanctum tokens in Laravel.

[](#track-and-manage-sessions-passport-tokens-and-sanctum-tokens-in-laravel)

This package allows you to track separately each login (session or token), attaching informations by parsing the User-Agent and saving the IP address.

Using a supported provider or creating your own custom providers, you can collect even more informations with an IP address lookup to get, for example, the geolocation.

You can revoke every single session/token or all at once. In case of sessions with remember tokens, every session has its own remember token. This way, you can revoke a session without affecting the others.

- [Compatibility](#compatibility)
- [Installation](#installation)
    - [Create the logins table](#create-the-logins-table)
    - [Prepare your authenticatable models](#prepare-your-authenticatable-models)
    - [Choose and install a user-agent parser](#choose-and-install-a-user-agent-parser)
    - [Configure the user provider (optional)](#configure-the-user-provider-optional)
    - [Laravel Sanctum](#laravel-sanctum)
- [Usage](#usage)
    - [Retrieving the logins](#retrieving-the-logins)
        - [Get all the logins](#get-all-the-logins)
        - [Get the current login](#get-the-current-login)
    - [Check for the current login](#check-for-the-current-login)
    - [Revoking logins](#revoking-logins)
        - [Revoke a specific login](#revoke-a-specific-login)
        - [Revoke all the logins](#revoke-all-the-logins)
        - [Revoke all the logins except the current one](#revoke-all-the-logins-except-the-current-one)
- [Events](#events)
    - [Login](#login)
- [IP address lookup](#ip-address-lookup)
    - [Ip2Location Lite DB3](#ip2location-lite-db3)
    - [Custom provider](#custom-provider)
    - [Handle API errors](#handle-api-errors)
- [Blade directives](#blade-directives)
- [License](#license)

Compatibility
-------------

[](#compatibility)

- For recent Laravel versions, use [Laravel Logins](https://github.com/alajusticia/laravel-logins).
- For previous versions of Laravel (v5.8, v6 and v7), use the [v2](https://github.com/alajusticia/laravel-auth-tracker/tree/v2).
- It works with all the session drivers supported by Laravel, except of course the cookie driver which saves the sessions only in the client browser and the array driver.
- To track API tokens, it supports the official **Laravel Passport (>= 7.5)** and **Laravel Sanctum (v2)** packages.

Installation
------------

[](#installation)

**/!\\ This documentation is for the v3 (WIP). The documentation for the latest release (v2) is available here: **

Install the package with composer:

```
composer require alajusticia/laravel-auth-tracker
```

Publish the configuration file (`config/auth_tracker.php`) with:

```
php artisan vendor:publish --provider="ALajusticia\AuthTracker\AuthTrackerServiceProvider" --tag="config"
```

### Create the logins table

[](#create-the-logins-table)

Before running the migrations, you can change the name of the table that will be used to save the logins (named by default `logins`) with the `table_name` option of the configuration file.

Launch the database migrations to create the required table:

```
php artisan migrate
```

### Prepare your authenticatable models

[](#prepare-your-authenticatable-models)

In order to track the logins of your app's users, add the `ALajusticia\AuthTracker\Traits\AuthTracking` trait on each of your authenticatable models that you want to track:

```
use ALajusticia\AuthTracker\Traits\AuthTracking;
use Illuminate\Foundation\Auth\User as Authenticatable;
// ...

class User extends Authenticatable
{
    use AuthTracking;

    // ...
}
```

### Choose and install a user-agent parser

[](#choose-and-install-a-user-agent-parser)

This package relies on a User-Agent parser to extract the informations.

Currently, it supports two of the most popular parsers:

- WhichBrowser ()
- Agent ()

Before using the Auth Tracker, you need to choose a supported parser, install it and indicate in the configuration file which one you want to use.

### Configure the user provider (optional)

[](#configure-the-user-provider-optional)

This step is optional if your application has only stateless authentication.

If you want to use the Auth Tracker for stateful authentication, this package comes with a modified Eloquent user provider that retrieve remembered users from the logins table instead of the users table.

In your `config/auth.php` configuration file, use the `eloquent-tracked` driver in the user providers list for the users you want to track:

```
'providers' => [
    'users' => [
        'driver' => 'eloquent-tracked',
        'model' => App\Models\User::class,
    ],

    // ...
],
```

### Laravel Sanctum

[](#laravel-sanctum)

In the actual version (2.9) of the Laravel Sanctum package, there is no event allowing us to know when an API token is created.

If you are issuing API tokens with Laravel Sanctum and want to enable auth tracking, you will have to dispatch an event provided by the Auth Tracker.

Dispatch the `ALajusticia\AuthTracker\Events\PersonalAccessTokenCreated` event passing the personal access token newly created by the `createToken` method of the Laravel Sanctum trait.

Based on the [example](https://laravel.com/docs/8.x/sanctum#issuing-mobile-api-tokens) provided by the Laravel Sanctum documentation, it might look like this:

```
use ALajusticia\AuthTracker\Events\PersonalAccessTokenCreated;
use App\Models\User;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Hash;
use Illuminate\Validation\ValidationException;

Route::post('/sanctum/token', function (Request $request) {
    $request->validate([
        'email' => 'required|email',
        'password' => 'required',
        'device_name' => 'required',
    ]);

    $user = User::where('email', $request->email)->first();

    if (! $user || ! Hash::check($request->password, $user->password)) {
        throw ValidationException::withMessages([
            'email' => ['The provided credentials are incorrect.'],
        ]);
    }

    $personalAccessToken = $user->createToken($request->device_name);

    event(new PersonalAccessTokenCreated($personalAccessToken)); // Dispatch here the event

    return $personalAccessToken->plainTextToken;
});
```

Usage
-----

[](#usage)

The `AuthTracking` trait provided by this package surcharge your users models with methods to list their logins and to give you full individual control on them.

### Retrieving the logins

[](#retrieving-the-logins)

#### Get all the logins

[](#get-all-the-logins)

```
$logins = request()->user()->logins;
```

#### Get the current login

[](#get-the-current-login)

```
$login = request()->user()->currentLogin();
```

### Check for the current login

[](#check-for-the-current-login)

Each login instance comes with a dynamic `is_current` attribute. It's a boolean that indicates if the login instance is the current login.

### Revoking logins

[](#revoking-logins)

#### Revoke a specific login

[](#revoke-a-specific-login)

To revoke a specific login, use the `logout` method with the ID of the login you want to revoke. If no parameter is given, the current login will be revoked.

```
request()->user()->logout(1); // Revoke the login where id=1
```

```
request()->user()->logout(); // Revoke the current login
```

#### Revoke all the logins

[](#revoke-all-the-logins)

We can destroy all the sessions and revoke all the Passport/Sanctum tokens by using the `logoutAll` method. Useful when, for example, the user's password is modified and we want to logout all the devices.

This feature destroys all sessions, even those remembered.

```
request()->user()->logoutAll();
```

#### Revoke all the logins except the current one

[](#revoke-all-the-logins-except-the-current-one)

The `logoutOthers` method acts in the same way as the `logoutAll` method except that it keeps the current session or Passport/Sanctum token alive.

```
request()->user()->logoutOthers();
```

Events
------

[](#events)

### Login

[](#login)

On a new login, you can listen to the event `ALajusticia\AuthTracker\Events\Login`. It receives a `RequestContext` object containing all the informations collected on the request, accessible on the event with the `context` property.

Properties available:

```
$this->context->userAgent; // The full, unparsed, User-Agent header
$this->context->ip; // The IP address
```

Methods available:

```
$this->context->parser(); // Returns the parser used to parse the User-Agent header
$this->context->ip(); // Returns the IP address lookup provider
```

Methods available in the parser:

```
$this->context->parser()->getDevice(); // The name of the device (MacBook...)
$this->context->parser()->getDeviceType(); // The type of the device (desktop, mobile, tablet, phone...)
$this->context->parser()->getPlatform(); // The name of the platform (macOS...)
$this->context->parser()->getBrowser(); // The name of the browser (Chrome...)
```

Methods available in the IP address lookup provider:

```
$this->context->ip()->getCountry(); // The name of the country
$this->context->ip()->getRegion(); // The name of the region
$this->context->ip()->getCity(); // The name of the city
$this->context->ip()->getResult(); // The entire result of the API call as a Laravel collection

// And all your custom methods in the case of a custom provider
```

IP address lookup
-----------------

[](#ip-address-lookup)

By default, the Auth Tracker collects the IP address and the informations given by the User-Agent header.

But you can go even further and collect other informations about the IP address, like the geolocation.

To do so, you first have to enable the IP lookup feature in the configuration file.

This package comes with two officially supported providers for IP address lookup (see the IP Address Lookup section in the `config/auth_tracker.php` configuration file).

### Ip2Location Lite DB3

[](#ip2location-lite-db3)

This package officially support the IP address geolocation with the Ip2Location Lite DB3.

Here are the steps to enable and use it:

- Download the current version of the database and import it in your database as explained in the documentation:
- Set the name of the `ip_lookup.provider` option to `ip2location-lite` in the `config/auth_tracker.php` configuration file
- Indicate the name of the tables used in your database for IPv4 and IPv6 in the `config/auth_tracker.php` configuration file (by default it uses the same names as the documentation: `ip2location_db3` and `ip2location_db3_ipv6`)

### Custom provider

[](#custom-provider)

You can add your own providers by creating a class that implements the `ALajusticia\AuthTracker\Interfaces\IpProvider` interface and use the `ALajusticia\AuthTracker\Traits\MakesApiCalls` trait.

Your custom class have to be registered in the `custom_providers` array of the configuration file.

Let's see an example of an IP lookup provider with the built-in `IpApi` provider:

```
use ALajusticia\AuthTracker\Interfaces\IpProvider;
use ALajusticia\AuthTracker\Traits\MakesApiCalls;
use GuzzleHttp\Psr7\Request as GuzzleRequest;
use Illuminate\Support\Facades\Request;

class IpApi implements IpProvider
{
    use MakesApiCalls;

    /**
     * Get the Guzzle request.
     *
     * @return GuzzleRequest
     */
    public function getRequest()
    {
        return new GuzzleRequest('GET', 'http://ip-api.com/json/' . Request::ip() . '?fields=25');
    }

    /**
     * Get the country name.
     *
     * @return string
     */
    public function getCountry()
    {
        return $this->result->get('country');
    }

    /**
     * Get the region name.
     *
     * @return string
     */
    public function getRegion()
    {
        return $this->result->get('regionName');
    }

    /**
     * Get the city name.
     *
     * @return string
     */
    public function getCity()
    {
        return $this->result->get('city');
    }
}
```

As you can see, the class has a `getRequest` method that must return a `GuzzleHttp\Psr7\Request` instance.

Guzzle utilizes PSR-7 as the HTTP message interface. Check its documentation:

The `IpProvider` interface comes with required methods related to the geolocation. All keys of the API response are accessible in your provider via `$this->result`, which is a Laravel collection.

If you want to collect other informations, you can add a `getCustomData` method in your custom provider. This custom data will be saved in the logins table in the `ip_data` JSON column. Let's see an example of additional data:

```
public function getCustomData()
{
    return [
        'country_code' => $this->result->get('countryCode'),
        'latitude' => $this->result->get('lat'),
        'longitude' => $this->result->get('lon'),
        'timezone' => $this->result->get('timezone'),
        'isp_name' => $this->result->get('isp'),
    ];
}
```

### Handle API errors

[](#handle-api-errors)

In case of an exception throwed during the API call of your IP address lookup provider, the FailedApiCall event is fired by this package.

This event has an exception attribute containing the GuzzleHttp\\Exception\\TransferException (see [Guzzle documentation](http://docs.guzzlephp.org/en/stable/quickstart.html#exceptions)).

You can listen to this event to add your own logic.

Blade directives
----------------

[](#blade-directives)

Check if the auth tracking is enabled for the current user:

```
@tracked
    Security
@endtracked
```

Check if the IP lookup feature is enabled:

```
@ipLookup
    {{ $login->location }}
@endipLookup
```

License
-------

[](#license)

Open source, licensed under the [MIT license](LICENSE).

###  Health Score

38

—

LowBetter than 83% of packages

Maintenance20

Infrequent updates — may be unmaintained

Popularity35

Limited adoption so far

Community10

Small or concentrated contributor base

Maturity71

Established project with proven stability

 Bus Factor1

Top contributor holds 100% of commits — single point of failure

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Every ~47 days

Recently: every ~135 days

Total

16

Last Release

1743d ago

Major Versions

v1.5.2 → v2.02020-04-03

PHP version history (3 changes)v1.0PHP ^7.1.3

v2.0PHP ^7.2.5

v2.1PHP ^7.2.5|^8.0

### Community

Maintainers

![](https://www.gravatar.com/avatar/9f22fbac3be34391e07c95c8400fa6ffca40fcec6792bbd5efb1cfb12050a3f8?d=identicon)[alajusticia](/maintainers/alajusticia)

---

Top Contributors

[![alajusticia](https://avatars.githubusercontent.com/u/17909018?v=4)](https://github.com/alajusticia "alajusticia (39 commits)")

###  Code Quality

TestsPHPUnit

### Embed Badge

![Health badge](/badges/alajusticia-laravel-auth-tracker/health.svg)

```
[![Health](https://phpackages.com/badges/alajusticia-laravel-auth-tracker/health.svg)](https://phpackages.com/packages/alajusticia-laravel-auth-tracker)
```

###  Alternatives

[alajusticia/laravel-logins

Session management in Laravel apps, user notifications on new access, support for multiple separate remember tokens, IP geolocation, User-Agent parser

2014.5k](/packages/alajusticia-laravel-logins)[vitalybaev/laravel5-dkim

Laravel 5/6 package for signing outgoing messages with DKIM.

3163.1k](/packages/vitalybaev-laravel5-dkim)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)