- What is aureola/laravel-teapot used for?
- It is a Laravel package that returns HTTP 418 I'm a teapot responses to suspected vulnerability scanners and other unwanted requests. It provides middleware, route macros, and helpers plus configurable messages and a tea-themed error page for playful APIs and demos.
- How do I install aureola/laravel-teapot in a Laravel application?
- Install the package with Composer using the name aureola/laravel-teapot, then follow the repository README for middleware registration, route setup, and any configuration publishing. The provided context does not list exact artisan commands, service-provider steps, or config keys, so confirm those in the source before integrating.
- Which Laravel and PHP versions does laravel-teapot support?
- The supplied context does not state supported Laravel or PHP versions, and it does not confirm a CI test matrix. Check the package composer.json and repository CI results before adopting it, because compatibility with your Laravel version is a critical unknown.
- How do I return an HTTP 418 response from a Laravel route using this package?
- The package exposes middleware, route macros, and helpers for returning proper teapot status codes. Because the README excerpt is empty, verify the exact macro and helper names in the repository before using them in routes or controllers.
- Can laravel-teapot integrate with fail2ban?
- The package is intended to support fail2ban integration through HTTP access logs, so suspicious requests can be matched and banned at the host level. The exact log format and its stability for fail2ban regexes are critical unknowns, so validate them in dry-run mode before enabling production jails.
- How does laravel-teapot determine the client IP behind a proxy or CDN?
- The provided context does not document how the package resolves client IPs behind proxies, CDNs, load balancers, IPv6, or trusted proxies. That is a security-sensitive unknown, so review the source and test against your actual infrastructure before relying on it for bans.
- Is laravel-teapot safe to use in production?
- It should be treated as a complementary detection and response layer, not a primary security control. The low adoption signals and security-sensitive logging behavior mean source review, compatibility testing, fail2ban dry-run validation, and rollback criteria are mandatory before production use.
- How can I avoid false-positive bans of legitimate users with the teapot trap?
- The context does not confirm built-in allowlists, dry-run mode, rate thresholds, or ban-duration guidance, so do not assume those controls exist. Start in staging with fail2ban dry-run mode, test NAT and corporate-proxy scenarios, maintain explicit allowlists, and canary one low-risk service before wider rollout.
- Does laravel-teapot work with route caching, config caching, or Laravel Octane?
- Compatibility with route caching, config caching, Octane, and queue workers is not confirmed in the provided context and is listed as a critical unknown. Test those deployment modes explicitly, including middleware ordering and whether trap routes are excluded from health checks.
- Is laravel-teapot actively maintained, and what are the alternatives?
- The package has low adoption signals, with 2 stars and 0 dependents in the assessment, and the context does not describe maintainer activity or a security response policy. Alternatives include a small custom Laravel middleware for HTTP 418 responses, WAF or web-server rules, and fail2ban patterns based on your own access logs.