Laravel Auth History

Reusable authentication history logging for Laravel 11–13.

The package listens to Laravel's login, logout, and failed-login events. It records the authenticatable model, guard, IP address, user agent, and timestamp without coupling to an application's User class.

Installation

composer require nathandunn/laravel-auth-history

php artisan vendor:publish --tag=auth-history-migrations
php artisan migrate

Laravel discovers the package service provider automatically.

Model integration

Add HasAuthHistory to any Eloquent authenticatable model:

use Illuminate\Foundation\Auth\User as Authenticatable;
use NathanDunn\AuthHistory\Traits\HasAuthHistory;

class User extends Authenticatable
{
    use HasAuthHistory;
}

Login, logout, and failed-login events for that model are now recorded automatically. Failed attempts without a resolved authenticatable are skipped.

Querying history

$history = $user->authHistories()
    ->with(['ipAddress', 'userAgent'])
    ->paginate();

$latestLogin = $user->authHistories()
    ->where('event', 'login')
    ->first();

$countryCode = $latestLogin?->ipAddress?->country_code;
$userAgent = $latestLogin?->userAgent?->user_agent;

IP addresses and user agents are stored once and reused across history records.

Optional IP enrichment

IP enrichment is disabled by default. Publish the configuration and enable IPinfo Lite:

php artisan vendor:publish --tag=auth-history-config

// config/auth-history.php
'ip_enrichment' => [
    'enabled' => true,
    'driver' => 'ipinfo',
    'token' => env('IPINFO_TOKEN'),
],

IPINFO_TOKEN=your-token

Only country code, ASN, and organisation name are stored. A lookup occurs only when an IP address is first discovered. Missing configuration, failed requests, and unavailable providers never prevent authentication history from being recorded.

To use another provider, implement NathanDunn\AuthHistory\Contracts\IpAddressEnricher and set its class as the driver:

'driver' => App\Auth\CustomIpAddressEnricher::class,

Configuration

Set enabled to false in config/auth-history.php to stop registering the authentication event listeners. Model classes can also be replaced under the models configuration key.

Testing

composer test
composer format-test