Put username in apache access_log with PHP and without HTTP auth

Question

In the Apache log configuration it is possible to specify that the HTTP auth user name should be logged. Most PHP scripts have their own, cookie-based authentication. Is it possible in PHP to provide Apache with a HTTP auth username for logging purposes, even if the authentication is cookie-based? If yes, how would the code look like? If not, what are alternatives?

Answer 1

Since Apache 2.4.7 Apache allows you to copy a response-header to a note. So if you don't run PHP as an Apache module (but for instance use PHP-FPM), and you also don't want the log-value to be sent to the client (which would usually happen if you set it in a response-header), here's a way to do it:

php:

header('X-Username: '.$username);

httpd.conf:

LogFormat "%h %l %u %t \"%r\" %>s %b \"%{username}n\"" logfmtname

vhost.conf:

CustomLog logs/vhost-access_log logfmtname

# copy response-header value to note
Header note X-Username username
# unset response-header so client won't get it
Header unset X-Username