Equivalent of ASP.NET HttpModules in PHP

Question

what is the equivalent of ASP.NET HttpModules in PHP?

If there are any how can I include them for that specific application (not globally) in other words what is the equivalent of web.config

Example : I need to log the request and the headers, if the server is returning a HTTP 500 error irrespective of the code which is run.

In ASP.NET, I would have a HTTP Module in which I can grab the response code and other details, before sending to the client. I can also handle Begin Request.

I need something similar in PHP

Answer 1

Unfortunately PHP is more like ASP in the sense that the "application" is a loose concept, the files are not tightly related, so anything you do would likely have to be at the web server level

Assuming you are on a linux/apache server. One approach would be to use .htaccess, these can be modified at the directory (ie application level) and have sever powerful features.

One example is for url re-writing:

http://roshanbh.com.np/2008/02/hide-php-url-rewriting-htaccess.html

Official Apache Docs: http://httpd.apache.org/docs/1.3/mod/mod_rewrite.html

Answer 2

You can look the ModSecurity for Apache: http://www.modsecurity.org/

It will allow you to log full POST and headers data depending on rules you define. ModSecurity configuration is very powerful but very complex too.

HTTP Traffic Logging

Web servers are typically well-equipped to log traffic in a form useful for marketing analyses, but fall short logging traffic to web applications. In particular, most are not capable of logging the request bodies. Your adversaries know this, and that is why most attacks are now carried out via POST requests, rendering your systems blind. ModSecurity makes full HTTP transaction logging possible, allowing complete requests and responses to be logged. Its logging facilities also allow fine-grained decisions to be made about exactly what is logged and when, ensuring only the relevant data is recorded. As some of the request and/or response may contain sensitive data in certain fields, ModSecurity can be configured to mask these fields before they are written to the audit log.