Download the PHP package mrnaeem4/ci3-request-analysis without Composer

ci3-request-analysis

CodeIgniter 3 hook that intercepts incoming HTTP requests, extracts structured metadata (headers, body, files, tenant, source IP, etc.), and writes one JSON Line per request directly to the CI3 application/logs directory — with sensitive-field redaction, body truncation, IP whitelisting, and daily log rotation with gzip compression.

Local logging only. No external server, no queue, no Guzzle. This is the CI3 counterpart of ci4-request-analysis.

Features

• Attachable per-request via a single CI3 hook (post_controller_constructor), not a global middleware.
• Writes directly to application/logs/analysis.log as JSON Lines (JSONL).
• Daily rotation: a file from a previous day is renamed and gzip-compressed automatically on the next write.
• Retention pruning: compressed logs older than REQUEST_LOG_RETENTION_DAYS (default 30) are deleted.
• Configurable sensitive-field redaction (default: password, nik, Api-Key, no_telp).
• Raw body truncation at 3 MB (configurable) with ... [truncated] suffix.
• File upload metadata captured without binary content (name, size, MIME, extension, SHA-256 hash, double-extension detection).
• IP/CIDR whitelist to skip private/internal traffic.
• PHP 7.4+.

Requirements

• PHP 7.4+
• CodeIgniter 3.x
• Composer (for autoloading), with a writable application/logs directory

Installation

Custom vendor-dir: If your composer.json sets "vendor-dir" (e.g. application/third_party/vendor), the package installs there. That is fine — just point $config['composer_autoload'] at that exact vendor/autoload.php path. CodeIgniter's TRUE shortcut only looks at application/vendor/ and the project root.

If you do not use Composer, add a PSR-4 autoloader mapping MrNaeem\Ci3RequestAnalysis\ to the src/ directory, or require the three classes manually:

Configuration

1. Enable hooks + Composer autoload

In application/config/config.php:

2. Register the hook

Important: CI3's array hook format (class/function/filename/ filepath) cannot resolve Composer namespaced classes — CI_Hooks::_run_hook() checks class_exists($class, false) (no autoload) and then require_onces the filepath/filename, which fails for vendor files. Use a closure instead (CI3 supports callables natively):

In application/config/hooks.php:

3. Load the .env file

CI3 does not parse a .env file by itself, and the config values are read with getenv(). Without loading the file, REQUEST_LOG_ENABLED is empty and the hook silently does nothing. Pick one:

Option A — vlucas/phpdotenv (recommended):

Load it in index.php (the front controller) before requiring CodeIgniter.php:

Option B — Apache SetEnv:

Option C — Nginx fastcgi_param:

4. Set environment variables

Values of the .env file (or server env):

Config reference

Path & method filtering

By default every request (including GET /) is logged. Restrict it:

Patterns are regex matched against the request path (e.g. /api/upload). includePaths is evaluated first; a request must match at least one include pattern when that list is non-empty. excludePaths wins afterwards.

Log payload

Each line in analysis.log is a JSON object (envelope + log_data):

How it works

The write is a single append with LOCK_EX, so it does not block the request and is safe for concurrent PHP-FPM workers.

Security

CI3 places index.php in the same directory as application/, so by default everything under application/ — including application/logs/analysis.log, which contains request headers and bodies — is reachable directly from the browser (http://host/application/logs/analysis.log). Apply at least one of the layers below; using all three is recommended.

1. Keep application/ out of the web root (recommended)

Move the front controller so the public web root only contains index.php, .htaccess and assets:

Then fix the paths in public/index.php (a copy of the original, with $system_path/$application_folder updated to ../system and ../application) and set $config['base_url'] accordingly in application/config/config.php.

2. Redirect the log directory outside the web root

Even with the default layout, point logs somewhere the browser cannot reach:

The hook falls back to application/logs only when REQUEST_LOG_DIR is empty.

3. Deny access with the web server

Apache — ship an .htaccess inside the log directory (and the application/ directory) with:

The sample app already includes sample/application/logs/.htaccess and sample/application/uploads/.htaccess. If AllowOverride is disabled, deny the paths in the vhost instead:

Nginx:

Laravel-style check — as a last line of defense, application/logs/.htaccess also rejects *.log / *.gz matches even if directory-level rules are ignored.

Notes

• By default every request is logged (including GET /). Use REQUEST_LOG_METHODS / REQUEST_LOG_INCLUDE_PATHS / REQUEST_LOG_EXCLUDE_PATHS to narrow it down — see Path & method filtering above.
• Binary file content is never stored; only metadata is captured.
• Redaction applies to both request headers (e.g. Cookie) and the body.
• application/logs should not be publicly accessible.

Sample app

A minimal CI3 application fragment lives under sample/:

• sample/application/config/config.php — hooks + Composer autoload enabled
• sample/application/config/hooks.php — hook registration
• sample/application/controllers/Home.php — post + upload demo endpoints
• sample/application/views/home/index.php — test forms

Copy the relevant files into an existing CI3 application and start your server.

Changelog

See CHANGELOG.md.

License

MIT