Logging Exceptions Without Exposing Secrets

Capture sufficient diagnostic context for maintainers while presenting generic errors and masking private values.

The examples introduce the underlying control before showing a verification and an application-level safeguard.

What You Will Build

Capture sufficient diagnostic context for maintainers while presenting generic errors and masking private values.

Prerequisites

Use PHP 8.4 or newer, HTTPS for all authentication operations, and an application session or database where required. Example configuration values are placeholders, never production secrets.

Example 1: Basic Operation

Log a correlation ID and exception type without returning internal details.

<?php
try { throw new RuntimeException('Database connection unavailable'); }
catch (Throwable $e) {
    $eventId = bin2hex(random_bytes(8));
    error_log(json_encode(['event' => 'server_error', 'id' => $eventId, 'type' => get_class($e)], JSON_THROW_ON_ERROR));
    http_response_code(500); echo 'Unexpected error. Reference: ' . $eventId;
}

Example 2: A Different Use Case

Explicitly drop secrets before serializing structured event context.

<?php
$context = ['user_id' => 42, 'authorization' => 'Bearer secret', 'route' => '/api/orders'];
unset($context['authorization']);
error_log(json_encode(['event' => 'denied', 'context' => $context], JSON_THROW_ON_ERROR));

Practical Example: Checking the Result

Use stable event fields suitable for filtering without raw request dumps.

<?php
$message = 'Operation failed';
$level = 'error';
error_log(json_encode(['level' => $level, 'message' => $message, 'at' => gmdate(DATE_ATOM)], JSON_THROW_ON_ERROR));

Important Behavior and Edge Cases

Never log access tokens, cookies, authorization headers, raw request bodies or exception payloads that could contain secrets.

Enforce controls on the server, test denial paths and do not assume that a snippet alone implements an entire production workflow.

Comparison with Related Functions

Common Beginner Mistakes

Key Takeaways

• Capture sufficient diagnostic context for maintainers while presenting generic errors and masking private values.
• Never log access tokens, cookies, authorization headers, raw request bodies or exception payloads that could contain secrets.
• Structured logs and correlation IDs help locate failures without exposing sensitive data.

Apply this behavior to a real application only after confirming the required extension, configuration and failure handling on the deployment runtime.