README

Yii Framework

Debug

Debugger and toolbar for Yii2 applications
Pico-inspired UI, scoped CSS, light/dark mode, and 14 inspection panels

Warning

Development only. Never enable the debugger in production. Keep access restricted to trusted development IPs and install production dependencies with composer install --no-dev.

Features

Quick start

Installation

Requires PHP 8.3 or newer and Yii2 22.x. The 0.2 line does not support Yii2 2.0.x.

composer require yii2-extensions/debug:^0.2 --dev

When upgrading from 0.1, review the changelog for breaking changes. Keep the debugger and php-forge/debug-core up to date together in the application's lock file.

Enable the debugger

In your application's entry script, set YII_ENV to dev before loading Yii. Then register the module in config/web.php, before returning $config:

if (YII_ENV_DEV) {
    $config['bootstrap'][] = 'debug';
    $config['modules']['debug'] = [
        'class' => \yii\debug\Module::class,
        'allowedIPs' => ['127.0.0.1', '::1'],
    ];
}

Keep the registration inside the development guard. Do not bootstrap the module in production.

Basic usage

Open an application page, expand the toolbar at the bottom, and select a panel chip to inspect the request. Use the Yii chip for Configuration and the PHP chip for PHP info. Switch between light and dark themes from the toolbar, and press Escape to close the drawer.

Open the debug/index route to browse retained requests. Select two captures in History to compare request metrics and panel changes, then open either capture for its details. Comparison shows structural counts without exposing panel values.

Configuration

The module runs with no options: up to 50 retained requests, captures under @runtime/debug, and a bottom toolbar. See the configuration reference for custom collectors and panels, the Inertia and Vite providers, database thresholds, IDE links, and the standalone router.

Security

The toolbar and debugger routes allow 127.0.0.1 and ::1 by default. Add only trusted development addresses to allowedIPs; never expose the debugger publicly. A checkAccessCallback can further restrict allowed requests.

Request, identity, queue, and Inertia captures redact common sensitive fields. Logs preserve original diagnostic values and are not redacted by the capture policy; SQL diagnostics can include substituted query values. Treat stored captures as sensitive and review them before sharing.

In the Events panel, context capture and source traces are disabled by default. This does not disable source traces in Logs or Database.

To redact additional exact keys, extend the defaults instead of replacing them:

use PHPForge\Debug\Helper\SensitiveDataRedactor;

$config['modules']['debug']['sensitiveKeys'] = [
    ...SensitiveDataRedactor::DEFAULT_KEYS,
    'tenant_signing_key',
];