- What does the dagasmart/login-guard package do?
- It is a Laravel package that adds login attempt throttling and brute-force protection to your authentication flow. It tracks failed login attempts, locks accounts or request sources once a threshold is reached, and lets you customize the guard rules, lockout durations, and the responses returned to clients. The goal is to block credential-stuffing and password-guessing attacks with minimal setup.
- How do I install dagasmart/login-guard in a Laravel application?
- Install it with Composer by running composer require dagasmart/login-guard. After that, follow the package's published configuration to register the guard and set your attempt limits. Because configuration is described as minimal-setup, most projects only need to publish the config file and adjust a few values.
- Which Laravel versions does dagasmart/login-guard support?
- The package is built for Laravel authentication, but the supported version range is declared in its composer.json requirements. Check the require section of the package on Packagist or the repository README before installing to confirm compatibility with your Laravel and PHP versions. If you are on an older or very new Laravel release, verify the constraints rather than assuming support.
- How do I configure the maximum number of login attempts before a user is locked out?
- The attempt limit is controlled through the package's configuration file, which you publish into your application's config directory. Adjust the max attempts value to match your security policy, then clear your config cache so the change takes effect. Values between three and five failures are common for standard login forms.
- Can I customize the lockout duration for blocked accounts?
- Yes. Lockout duration is one of the configurable guard rules the package exposes, so you can set how long a user or source stays blocked after exceeding the attempt limit. Shorter windows reduce support burden for legitimate users, while longer windows give stronger protection against sustained attacks. You can tune this per environment if you want stricter rules in production.
- How do I customize the response a locked-out user receives?
- The package lets you customize the responses returned when throttling or a lockout is triggered, so you can return a friendly redirect with an error message or a JSON error payload for API clients. Keep the message informative but generic enough that it does not reveal whether a specific account exists. For APIs, pair it with an appropriate HTTP status such as 429 or 423.
- Does login-guard throttle by account, by IP address, or both?
- The package is designed around configurable guard rules, which means you define the key that attempts are tracked against, such as the submitted username or email, the request IP, or a combination of both. Tracking by account stops targeted guessing, while tracking by IP stops a single source from spraying many accounts. Combined rules are usually the safest default for public login forms.
- Will dagasmart/login-guard work with Laravel Fortify, Breeze, Jetstream, or my own login controller?
- Because the package hooks into the Laravel authentication flow rather than replacing it, it can be layered onto custom login controllers as well as starter kits built on Laravel's native auth. The exact integration point depends on how your app performs the credential check, so review the package README for the recommended wiring. Confirm behavior in a staging environment before relying on it in production.
- Does login-guard require Redis or a database table?
- Attempt counters and lockout state have to be stored somewhere, and the package's supported stores are documented in its configuration and README. Laravel's cache driver is the usual backing store, so options like Redis, Memcached, or the database cache driver may apply depending on what you have configured. Pick a shared, persistent store in multi-server deployments so throttling works consistently across nodes.
- How can I test throttling and reset a lockout during development?
- In your test suite, fire repeated failed login requests and assert that the expected lockout response is returned once the threshold is crossed; use an isolated cache store so tests do not interfere with each other. During development, clearing the relevant cache keys or the cache store resets attempt counters and lifts a lockout. Check the package README for any provided reset helpers before writing your own.