Weave Code
Filament Password Rotation Laravel Package
bbs-lab/filament-password-rotation
A Filament plugin for Laravel that adds configurable password rotation policies. Enforce password expiration, track password history, and prompt users to update credentials at login or within Filament panels, helping teams meet security requirements without custom code.
Password rotation for Filament — forced-change page, reuse prevention & expiry warnings for any authenticatable. Filament v4 & v5.
Frequently asked questions about Filament Password Rotation
- How do I install bbs-lab/filament-password-rotation in a Laravel app?
- Install it with composer require bbs-lab/filament-password-rotation, then register the plugin in your Filament panel provider. Publish and run any config or migrations the README calls for, and clear cached config. Confirm your panel's Filament major matches the package's composer.json before installing.
- Which Filament and Laravel versions does this password rotation plugin support?
- It declares support for Filament v4 and v5 and is built for Laravel applications with a Filament panel. Check the package's composer.json for the exact Laravel and PHP constraints, because the plugin is coupled to Filament's component contract. Confirm your panel's exact Filament minor version before upgrading either side.
- How does forced password rotation and expiry warning work inside Filament?
- The plugin adds a forced-change page and expiry warnings for users whose passwords have reached the configured lifetime. At login or within the panel, affected users are prompted to set a new password before continuing. It also tracks password history to block reuse according to your policy.
- How do I configure password expiry, reuse prevention, and history depth?
- Publish the package configuration and set the expiry window, warning lead time, and history or reuse limits as documented in the README. Defaults may change between releases, so pin the package and re-check config after upgrades. Clear cached config after editing.
- Does it work with any authenticatable model or only Filament's user model?
- The package is positioned for any authenticatable, so you can apply rotation to multiple user models and guards where your panel supports them. The forced-change page is still a Filament page, so the model must be usable in that panel context. Confirm guard and provider wiring in your app before relying on it for non-default models.
- What happens if a user bypasses the Filament panel through an API or CLI?
- The plugin enforces rotation at the Filament UI layer only; it does not automatically cover API tokens, CLI logins, or public auth flows outside Filament. If those paths matter, add server-side checks such as middleware or a password_changed_at guard condition. Treat the package as the UX front-end to a policy you own.
- How do I test forced password change and expiry flows in Laravel?
- Create users with an expired or reused password and assert they are redirected to the forced-change page when accessing the panel. Use Filament's testing helpers for the form and Laravel's auth and test utilities for the underlying model state. Also test any server-side enforcement you add outside the panel.
- Is v2.1.2 safe to use, and how do I verify the v2.1.3 autofill fix?
- v2.1.2 was published to Packagist pointing at a different commit than intended, so the autofill markup fix did not ship in that tag; use v2.1.3 or later and pin an exact reference. Audit any environment that resolved v2.1.2 by comparing the installed commit with the upstream tag. Ask the maintainer whether tags are immutable going forward and whether v2.1.2 was retagged or abandoned.
- Does the autofill suppression work with 1Password, Bitwarden, and Safari?
- The hidden username anchor plus current-password and new-password tokens is a known pattern for defeating Chrome's saved-password autofill and strong-password generator. Behavior with 1Password, Bitwarden, Safari, and Firefox is best-effort and can vary by browser and extension version. Test with the password managers your users actually have, and treat suppression as a UX improvement rather than a security control.
- What are alternatives to bbs-lab/filament-password-rotation, and what is the exit cost?
- Alternatives include custom Laravel middleware with a password_changed_at column, Fortify or Breeze password rules, or a small in-house Filament forced-change page. This package is a focused Filament UX layer, not a replacement for Fortify, Breeze, SSO, or API token policies. Exit cost is low if you keep the server-side policy separate and the forced-change page replaceable.
Weaver
How can I help you explore Laravel packages today?