Sessions table no ip address

Laravel Database Sessions Table without IP Address & User Agent Collection – GDPR friendly

For some strange reason Laravel collects IP addresses and user agents in the Session Database Table driver.

Almost all session drivers, except from the database driver don’t seem to collect IP addresses.

The Simple Way

To prevent this mostly, the easiest (almost non-code) way is to change the column types of the ip address and user agent in the migration of the sessions database table to boolean instead of varchar.

Schema::create('sessions', function (Blueprint $table) {

In this example, the ip address and user agent are reduced to tiny integers, leaving only the first octet.

Since the sessions are only searched on id and not on ip address or user agent this seems safe. But always verify this yourself. If the Laravel code were to ever update to search on user agent and ip address, random sessions can be selected, which might become a vulnerability.

It also could happen that ip + user agent data still will be logged in MySQL logs or other logs. So the code way below could be more robust.

There are other ways by overwriting / extending the session driver:

The Code Way

That led to the code way. I think this is the most elegant way. You can also create a custom Database Session driver:



namespace App\Providers;

use Illuminate\Pagination\Paginator;
use Illuminate\Support\ServiceProvider;

// Session part
use App\Extensions\SimpleDatabaseSessionHandler;
use Illuminate\Contracts\Foundation\Application;
use Illuminate\Support\Facades\Session;
use Illuminate\Database\ConnectionInterface;

class AppServiceProvider extends ServiceProvider

     * Register any application services.
    public function register(): void
     * Bootstrap any application services.
    public function boot(ConnectionInterface $connection): void

        Session::extend('database-simple', function (Application $app) use ($connection) {
            $table   = \Config::get('session.table');
            $minutes = \Config::get('session.lifetime');
            return new SimpleDatabaseSessionHandler($connection, $table, $minutes);



Then add the file app\Extensions\SimpleDatabaseSessionHandler.php . This overwrites the extra ip address and user agent info being added.

namespace App\Extensions;

use Illuminate\Session\DatabaseSessionHandler;
class SimpleDatabaseSessionHandler extends DatabaseSessionHandler
     * Add the request information to the session payload.
     * @param  array  $payload
     * @return $this
    protected function addRequestInformation(&$payload)
        return $this;

And finally change your session driver in config/session.php to:

'driver' => 'database-simple',

You don’t need to change the database migration in this way.

Use at your own risk of course, test it well and if you spot any bugs, please let us know :).

Leave a Comment

Your email address will not be published. Required fields are marked *

Scroll to Top