Weave Code
Shield Laravel Package
artesaos/shield
Artesaos Shield gives Laravel apps a lightweight authorization layer for roles and permissions. Define abilities once, assign them to users, and protect routes, controllers, and Blade views with simple, expressive checks.
A simple way to centralize your validation rules
Frequently asked questions about Shield
- Does artesaos/shield work with Laravel 10 or Laravel 11?
- No. The last release was July 2016, which predates Laravel package auto-discovery and constrains illuminate/support to the Laravel 5.1–5.4 era. Composer will not resolve it against Laravel 9, 10, 11, or 12 on PHP 8.1+.
- Is artesaos/shield still maintained?
- No. The most recent release is 2016-07-02 — roughly nine years without a release — and the repository sits at around 32 stars, so it is effectively end-of-life rather than a low-cadence project. There is no visible maintainer activity to ship a fix if a security issue were discovered.
- Why does composer require artesaos/shield fail on modern Laravel?
- The package's composer.json pins illuminate/support to the Laravel 5.1–5.4 era and PHP to the 5.6/7.0 era. On any current application the constraint graph cannot be satisfied, so Composer fails outright rather than installing a degraded version.
- What are the best alternatives to artesaos/shield for Laravel roles and permissions?
- The two credible options are Laravel's first-party Gate and Policy layer backed by a small internal roles table, or spatie/laravel-permission, the de facto ecosystem standard with active maintenance. Shield is not a competitive choice given its abandonment.
- Does artesaos/shield integrate with Laravel Gate and Policies?
- The package describes itself as Gate/Policy friendly, and that is the architecturally correct posture: Laravel's native Gate and Policy layer should remain the enforcement point while the package supplies role and permission facts. You would need to read the middleware and helpers line by line to confirm enforcement actually routes through Gate rather than bypassing it.
- Is artesaos/shield safe to use in production?
- No. Authorization sits on the hot path of every request, so an unaudited dependency with no visible security disclosure process, no CVE history, and no active maintainer is inappropriate for production. Specific risks include fail-open middleware when a permission record is missing and request-scoped state leaking under long-lived workers.
- How do I install and configure artesaos/shield on an older Laravel version?
- On a legacy Laravel 5.1–5.4 application, install via Composer, then manually register the service provider and facade alias in config/app.php and wire the middleware in app/Http/Kernel.php. Auto-discovery did not exist in that era, and you should verify the published migrations and their down() path before running them against a shared database.
- Does artesaos/shield support Laravel Octane?
- Unlikely. Packages from that era commonly bind request-scoped state such as the current user or loaded roles into container singletons, which under Octane's long-lived workers can leak authorization state between requests — a severe, hard-to-reproduce defect. Assume incompatibility until proven otherwise.
- What database tables and migrations does artesaos/shield add?
- Expect roles, permissions, and pivot tables linking them to users, since the package owns a persistent domain model rather than just wrapping an API. The migration footprint is unverified, so check for table naming collisions with your existing schema, whether migrations are publishable or auto-loaded, and whether down() rolls back cleanly.
- How does artesaos/shield compare to spatie/laravel-permission?
- spatie/laravel-permission is actively maintained, widely adopted, and resolves against current Laravel and PHP versions, while Shield has had no release since 2016 and cannot be installed on modern applications at all. Shield's only theoretical advantage is a smaller feature surface, which does not offset the abandonment and security risk.
Weaver
How can I help you explore Laravel packages today?