Put username in apache access_log with PHP and without HTTP auth

Question

In the Apache log configuration it is possible to specify that the HTTP auth user name should be logged. Most PHP scripts have their own, cookie-based authentication. Is it possible in PHP to provide Apache with a HTTP auth username for logging purposes, even if the authentication is cookie-based? If yes, how would the code look like? If not, what are alternatives?

Answer 1

A possibility is to store usernames & past session_ids somewhere else, and let the log write the cookie values in it (usually %{PHPSESSID}C), which you then can trace back.

Another option would be to send a header with the username back to the client, preferably right after your session_start:

PHP:

header('X-Php-Sess-User: '.$username);

Customlog:

%{X-Php-Sess-User}o

Answer 2

Short of using an Apache handler to touch the internal auth* data structures, your best bet is to resort to environment variables. You would set a top-level environment variable using apache_setenv in your PHP code

apache_setenv('USERID','jrodriguez',true);

and then write the value to the log file with a LogFormat entry in your Apache config using "%{USERID}e" instead of "%u"

LogFormat "%v:%p %h %l %{USERID}e %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" envuid_combined
CustomLog /path/to/access.log envuid_combined

Of course, the real credentials when performing actual HTTP auth would be lost forever, so consider saving %u somewhere else -- either in a new field or in a parallel log file.