Weave Code
Defender Laravel Package
artesaos/defender
Artesaos Defender is a Laravel ACL package for role- and permission-based access control. It provides middleware, Blade directives, caching, and a simple API for assigning roles and abilities to users so you can protect routes and UI consistently.
Roles & Permissions for Laravel
Frequently asked questions about Defender
- What is Artesaos Defender and how does it work in Laravel?
- Artesaos Defender is a role-and-permission ACL package for Laravel that lets you define roles and permissions, assign them to users, and authorize actions through the Defender facade, middleware, and Blade checks. It uses Eloquent models and pivot tables, so authorization data lives in your application database. It fits simple RBAC needs in a monolithic Laravel app rather than teams, multi-tenancy, or resource-level policy inheritance.
- How do I install and configure Artesaos Defender in a Laravel app?
- Install it with Composer, publish its migrations and configuration, and run the migrations to create the roles and permissions tables. Add the package traits to your user model, register the middleware aliases, and seed the roles and permissions your application needs. The exact commands and trait names should be confirmed against the package README for the version you install.
- Does Artesaos Defender support Laravel 10, 11, or 12?
- No. The v0.12.0 release adds Laravel 9 support, but the supported ceiling remains Laravel 9, so Laravel 10, 11, and 12 are not supported. If your application targets Laravel 10 or newer, this package does not unblock adoption. Treat compatibility as proven only for the exact Laravel 9 and PHP matrix you validate.
- Is Artesaos Defender actively maintained and safe for production?
- Defender is still pre-1.0 and has no listed dependents, so real-world validation is thin and minor-version bumps may include breaking changes. The v0.12.0 release adding Laravel 9 support does not by itself establish a maintenance cadence. Because authorization is a high-blast-radius area, you should assign an owner for security review and patching before relying on it in production.
- How do I check a user's role or permission with the Defender facade?
- Defender exposes authorization checks through its facade, and the package also provides Blade-friendly checks for conditionally rendering UI. You typically call the facade from controllers, middleware, or views to test whether the current user has a role or permission. Keep the checks centralized where possible so authorization logic does not scatter across controllers and templates.
- How do I protect Laravel routes with Artesaos Defender middleware?
- Defender ships middleware that you register as aliases and then attach to routes or route groups. The middleware checks the authenticated user's roles or permissions before allowing the request to proceed. Confirm the alias names and middleware parameters in the package documentation for your installed version.
- What are the caching and performance considerations for Defender permission checks?
- The package includes caching for permission checks, which helps reduce database queries on high-traffic requests. However, cache invalidation behavior is not clearly documented, so you should test how role and permission changes propagate after updates. For high request volume, measure permission checks under cache misses and define a strategy for clearing or warming the cache.
- When should I use Laravel Gates and Policies instead of Artesaos Defender?
- Laravel-native Gates and Policies are the safer default for greenfield applications and for teams that want framework-maintained authorization. Defender is a defensible tactical choice mainly for a legacy Laravel 9 application where replacing it now would cost more than keeping it. If you need centralized, auditable, framework-independent authorization, neither simple RBAC package may be the right fit.
- Does Artesaos Defender support teams, multi-tenancy, wildcard permissions, or audit trails?
- Defender is a conventional RBAC package built around roles, permissions, pivots, middleware, and Blade helpers. It is not designed for teams, multi-tenancy, policy inheritance, delegated administration, or fine-grained resource-level authorization. If those requirements are on your roadmap, evaluate a more capable authorization layer or Laravel's native policy system.
- How do I migrate off Artesaos Defender or plan an exit strategy?
- Start by inventorying every role, permission, middleware alias, Blade check, and facade call so you know the full authorization surface. Map those rules to Laravel Gates and Policies or another maintained package, then migrate in stages with tests that cover both allow and deny paths. Because Defender is capped at Laravel 9 and pre-1.0, define an exit date before adopting it and account for the migration cost in your upgrade planning.
Weaver
How can I help you explore Laravel packages today?