How to listen/log/catch validation errors?

[willsmanley]

Across hundreds of controller methods in my JSON-response API, nearly every one of them uses request()->validate().

The behavior works great, but since it doesn't throw any exceptions (to my knowledge), I don't get any logs when these errors occur.

To be able to listen for and log these errors would be a great way to resolve bugs faster and generally improve development.

And I don't want to have to re-write any controller methods. I would like to be able to register an event listener or similar and just log all of the errors.

Unfortunately I can't find any documentation on how to do this. Does anybody have a clue as to where to start?

[devcircus]

It's not generally a good idea to report validation exceptions, especially for high traffic apps. They are included in the frameworks internal "dontreport" array. They're converted to responses as that is the usual use-case. However, all exceptions pass through your app's exception handler. So just check for validation exceptions and do what you need before sending it on to the parent class.

If you're using form requests, you could also change the behavior there, or in a parent/trait of form requests, if you want.

The exception handler is at app\Exceptions\Handler.

[willsmanley]

Ah thanks a lot. Didn't even think to look at the internalDontReport array.

I already have some custom logic in app\Exceptions\Handler so I think what I'll do is conditionally log ValidationException only for certain URLs that need more attention and are not supposed to have validation problems from a front-end perspective (ie. a field that is too long or contains invalid characters should be proactively prevented in javascript instead of making it to the request validation stage).

[Wulfheart]

Sorry for the late response: OWASP says something differently.
https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html

Where possible, always log:

Input validation failures e.g. protocol violations, unacceptable encodings, invalid parameter names and values