- How do I install customergauge/session in a Laravel application?
- Install it with Composer using composer require customergauge/session, then configure Laravel's session driver to use the package's native PHP session adapter. Verify the release tag actually resolves on Packagist before relying on it, because the package metadata has raised hygiene concerns. You will also need to reconcile cookie encryption, CSRF handling, and session startup with your existing Laravel configuration.
- Which Laravel and PHP versions does customergauge/session support?
- The technical assessment positions the package for PHP 8.1+ and Laravel 10 through 12, but that is a best-fit profile rather than a guarantee. You must confirm that its illuminate/session constraint resolves against your exact Laravel major, especially Laravel 11 and 12 where the session contract has moved. Check the composer.json constraints and run a real install before committing.
- How does customergauge/session integrate with Laravel's SessionGuard?
- It backs Laravel's Illuminate session contract with PHP's native $_SESSION superglobal, so SessionGuard can read and write auth state that legacy PHP code also sees. This is the correct extension point because SessionGuard depends on the session contract rather than a concrete store. The catch is that the contract is much larger than get and put, so confirm the adapter fully implements migrate, invalidate, token regeneration, and flashbags before trusting it with authentication.
- Can I share a session between a legacy PHP app and a Laravel app?
- Yes, that is the package's core use case: a hybrid deployment where a plain PHP application and a Laravel application share one session cookie and one $_SESSION array. You must prevent StartSession from double-starting the session, add the native session cookie name to EncryptCookies::$except, and unify or disable CSRF verification on bridged routes. Cookie flags such as secure, httponly, samesite, domain, and path will come from php.ini rather than config/session.php and can drift.
- Does customergauge/session work with Laravel Octane, Swoole, or RoadRunner?
- It is dangerous under Octane, Swoole, or RoadRunner because $_SESSION is process-global while those runtimes require strict request isolation. The catastrophic failure mode is cross-user session data leakage, not a visible bug. For long-running workers, use Laravel's Redis, database, or cookie session drivers instead.
- How do I handle CSRF and encrypted cookies when bridging PHP $_SESSION with Laravel?
- Laravel encrypts its session payload while plain PHP does not, so mixing them is both a data-integrity and a compliance question if the session carries sensitive values. Add the native session cookie name to EncryptCookies::$except and either unify the CSRF token lifecycle across both applications or disable VerifyCsrfToken on bridged routes. Also review cookie flags in php.ini, because they will not follow config/session.php.
- Does the package fully implement flash data, remember-me, logout, and session migration?
- That is the key due-diligence question and cannot be assumed from a successful smoke test. SessionGuard::logout calls migrate(true) and regenerateToken, login writes the guard name and queues a recaller cookie, and flash data uses a flashbag with its own age-out semantics. If migrate or invalidate does not map correctly to session_regenerate_id(true), you get a silent session-fixation vulnerability rather than a visible bug.
- How do I test a Laravel app that uses native PHP sessions with PHPUnit or Pest?
- $_SESSION is process-global, which is hostile to parallel PHPUnit or Pest runs and can leak state between tests. Reset the superglobal in setUp and tearDown, use process isolation where necessary, and avoid parallel test execution for bridged routes. For most application tests, keep using Laravel's array or Redis session drivers and test the adapter separately.
- Is customergauge/session safe and actively maintained for production use?
- Treat it as elevated technical risk. It has roughly 9 stars, 0 dependents, a single vendor in CustomerGauge, and a bus factor of 1, which reads as an internal extraction published for convenience rather than community infrastructure. The stated last release date is forward-dated, so verify the tag and changelog, confirm the MIT source can be vendored and forked, and get any support posture in writing before production adoption.
- What are the alternatives to customergauge/session for sharing sessions between Laravel and legacy PHP?
- For greenfield Laravel, prefer the Redis, database, or cookie session drivers because they offer better isolation, scalability, testability, and encryption with no extra dependency. For hybrid deployments, a shared Redis or database session store accessible to both applications is often safer than exposing $_SESSION. If you must bridge native PHP sessions, keep the adapter behind a config flag so rollback is a one-line change.