Geoblocking Bundle Laravel Package

Technical Evaluation

Architecture Fit

• Symfony2 Bundle for Laravel/PHP: The package is a Symfony2 bundle, not a Laravel package, which introduces a mismatch in architecture. Laravel’s service container, routing, and event systems differ significantly from Symfony’s. Direct integration would require abstraction layers (e.g., wrapping Symfony components in Laravel-compatible services) or a rewrite of core logic.
• GeoIP Dependency: Relies on geoip_country_code_by_name() (deprecated in PHP 7.2+) or MaxMind’s GeoIP Bundle, neither of which are natively Laravel-friendly. Laravel alternatives like geoip2/geoip2 or league/geoip would need adaptation.
• Event-Driven Model: Uses Symfony’s kernel.request event listener. Laravel’s equivalent is the Illuminate\Http\Kernel middleware pipeline, requiring a custom middleware to replicate functionality.

Integration Feasibility

• High Effort: Converting this bundle to Laravel would require:
  • Replacing Symfony’s EventDispatcher with Laravel’s service container + middleware.
  • Adapting route-based blocking (Symfony’s Router → Laravel’s RouteServiceProvider).
  • Rewriting configuration handling (Symfony’s config.yml → Laravel’s config/geoblocking.php).
• Partial Reuse: The core logic (country-based blocking, whitelisting, cookie bypass) could be ported, but Symfony-specific dependencies (e.g., FOSUserBundle) would need alternatives (e.g., Laravel’s laravel/breeze or laravel/fortify).

Technical Risk

• Deprecated PHP Functions: The default geoip_country_code_by_name() is obsolete (removed in PHP 8.0). Migration to MaxMind DB (geoip2/geoip2) or IP-API would be mandatory.
• Symfony Lock-in: Tight coupling with Symfony’s EventDispatcher, Router, and FOSUserBundle complicates Laravel integration. Risk of hidden dependencies (e.g., assumed Symfony services).
• Testing Overhead: No Laravel-specific tests; would require rewriting test suites for Laravel’s ecosystem (e.g., Pest, Laravel Dusk).
• Performance: GeoIP lookups are CPU-intensive. Laravel’s middleware pipeline must handle this without blocking requests excessively.

Key Questions

1. Is Symfony interoperability a hard requirement?
   • If yes, consider keeping Symfony or using a micro-service architecture (e.g., a separate Symfony app for geoblocking via API).
   • If no, proceed with a Laravel-native rewrite.
2. What’s the target PHP version?
   • PHP 7.4+ requires MaxMind DB or IP-API instead of deprecated geoip functions.
3. How critical is real-time blocking?
   • GeoIP lookups add latency (~50–200ms). Caching (e.g., Redis) may be needed.
4. Are there existing Laravel alternatives?
   • Evaluate spatie/geo or laravel-geoip for simpler integration.
5. How will user authentication be handled?
   • FOSUserBundle is Symfony-specific. Laravel alternatives (e.g., laravel/sanctum, laravel/jetstream) would need adaptation.

Integration Approach

Stack Fit

• Laravel Compatibility: Low due to Symfony-specific components. A custom middleware-based solution is the most feasible path.
• Recommended Stack:
  • GeoIP: Use geoip2/geoip2 (MaxMind DB) or league/geoip for IP-to-country resolution.
  • Authentication: Replace FOSUserBundle with Laravel’s built-in auth (e.g., Auth::check()).
  • Routing: Leverage Laravel’s middleware groups or route filters for blocking logic.
  • Configuration: Store rules in config/geoblocking.php (Laravel’s native format).

Migration Path

1. Phase 1: Proof of Concept (PoC)

   • Build a Laravel middleware that replicates core geoblocking logic:

     namespace App\Http\Middleware;
     use Closure;
     use GeoIp2\Database\Reader;
     use Illuminate\Http\Request;
     
     class GeoBlockMiddleware {
         public function handle(Request $request, Closure $next) {
             $ip = $request->ip();
             $reader = new Reader('/path/to/GeoLite2-Country.mmdb');
             $country = $reader->country($ip)->getCountry()->getIsoCode();
     
             if ($this->isBlocked($country, $request)) {
                 abort(403, 'Access denied by geoblocking rules.');
             }
             return $next($request);
         }
     
         protected function isBlocked(string $country, Request $request): bool {
             // Implement whitelist/blacklist logic here
         }
     }
     

   • Register middleware in app/Http/Kernel.php:

     protected $routeMiddleware = [
         'geo.block' => \App\Http\Middleware\GeoBlockMiddleware::class,
     ];
     

   • Apply to routes:

     Route::middleware(['geo.block'])->group(function () {
         // Routes to block
     });
     

2. Phase 2: Configuration System

   • Replace Symfony’s config.yml with Laravel’s config/geoblocking.php:

     return [
         'enabled' => true,
         'block_anonymous_only' => true,
         'whitelisted_countries' => ['CH', 'FR', 'DE'],
         'blacklisted_countries' => ['US', 'CN'],
         'whitelisted_routes' => ['login', 'logout'],
         'ip_whitelist' => ['127.0.0.1', '192.168.*.*'],
         'allow_search_bots' => true,
         'search_bot_domains' => ['.googlebot.com'],
         'allow_cookie' => [
             'enabled' => true,
             'cookie_name' => 'geoblocking_allow',
         ],
     ];
     

   • Bind config to middleware via Laravel’s service container.

3. Phase 3: Cookie & Bot Handling

   • Add logic to check for geoblocking_allow cookie:

     if ($request->hasCookie('geoblocking_allow') && $request->cookie('geoblocking_allow') === 'true') {
         return $next($request); // Bypass block
     }
     

   • Implement user-agent parsing for search bots (e.g., using spatie/browsers).

4. Phase 4: Performance Optimization

   • Cache GeoIP lookups in Redis:

     $cacheKey = "geoip:{$ip}";
     $country = cache()->remember($cacheKey, now()->addHours(1), function () use ($ip) {
         return $reader->country($ip)->getCountry()->getIsoCode();
     });
     

   • Use queue workers for async blocking checks if latency is critical.

Compatibility

• Symfony → Laravel Mappings:

  Symfony Component	Laravel Equivalent
  kernel.request event	Middleware (handle() method)
  FOSUserBundle	Laravel Auth (Auth::user())
  config.yml	config/geoblocking.php
  Twig templates	Laravel Blade or Twig (if installed)

• Dependencies:
  • Drop: azine/geoblocking-bundle, maxmind/geoip (Symfony bundle).
  • Add: geoip2/geoip2, spatie/browsers (for bot detection).

Sequencing

1. Assess Scope: Decide if a full rewrite or partial integration (e.g., only route-based blocking) is needed.
2. Prototype Middleware: Validate core logic before full implementation.
3. Replace GeoIP Backend: Migrate from geoip_country_code_by_name() to geoip2/geoip2.
4. Integrate Auth: Ensure logged-in users bypass blocks (use Auth::check()).
5. Test Edge Cases: Private IPs, cookies, bots, and cached responses.
6. Deploy & Monitor: Roll out in stages (e.g., block non-critical routes first).

Operational Impact

Maintenance

• Pros:
  • Laravel-native code is easier to maintain long-term.
  • **