- How do I install divineomega/laravel-password-exposed-validation-rule?
- Install it as a Composer dependency with composer require divineomega/laravel-password-exposed-validation-rule and pin v6.1.0 initially if you want a known baseline. Laravel package auto-discovery should register the service provider, but confirm any configuration publishing or environment settings in the README. Then add the rule to your FormRequest or Validator rules array.
- Which Laravel and PHP versions does this password breach validation rule support?
- Version 6.1.0 declares support from Laravel 8 and PHP 7.4 up to Laravel 13 and PHP 8.5. That broad range is convenient, but you should still test on your exact PHP and Laravel runtime. Verify that Laravel 13 and PHP 8.5 are generally available and acceptable for your project before relying on the ceiling.
- How do I use the exposed password rule in a Laravel FormRequest?
- Add the package rule class to the rules array for your password field, alongside Laravel rules such as required, string, and confirmed. Compose it explicitly with string and type rules so validation order is predictable. The rule then checks the submitted password value against the breach source during validation.
- Does this package send plaintext passwords to Have I Been Pwned?
- The package checks passwords against Have I Been Pwned, and HIBP breach lookups are typically designed around k-anonymity so only a hash prefix is sent rather than the plaintext password. Confirm the exact request behavior for your pinned package version in its README or source before production use. Also review your privacy and egress requirements for any external API call.
- What happens if the Have I Been Pwned API is down or times out during validation?
- The package depends on an external breach lookup, so timeout, outage, and rate-limit behavior matter operationally. Configure sensible timeouts and consider caching results where appropriate, then decide whether your application should fail open or fail closed when the lookup cannot complete. Test these failure modes explicitly rather than assuming validation behavior during an outage.
- Why did non-string password values behave differently in v6.1.0?
- The release changed non-string handling so the package delegates non-string inputs to Laravel string and type rules while still checking objects with a string representation. This can affect existing validations that relied on prior conversion warnings or breach lookups for non-strings. Add regression tests for integer-like values and objects implementing __toString, and compose the rule with string validation explicitly.
- Can I cache breach lookups to reduce password validation latency?
- Yes, caching is advisable if your application validates the same values repeatedly or receives high registration traffic. Cache results around the breach lookup rather than storing plaintext passwords, and avoid validating the same input multiple times in a single request path. Also account for rate limits and monitor latency before expanding the rule to more flows.
- Is this package suitable for production registration and password reset flows?
- It fits well because it plugs into Laravel's native validation pipeline and requires little architectural change. Roll it out first to registration and password-reset flows, then monitor external lookup latency, error rates, and privacy requirements. Because the package carries an external breach-lookup dependency, production readiness depends heavily on your caching and failure-mode configuration.
- How do I test this Laravel password exposed validation rule without hitting the external API?
- Mock or fake the HTTP client used for the Have I Been Pwned request and assert the rule passes or fails for the expected values. Include tests for the rule composed with required, string, confirmed, and other Laravel rules, plus non-string and Stringable inputs. Keep a small staging check against the real service to confirm endpoint behavior and timeouts.
- What alternatives exist to this Laravel password breach validation rule?
- Laravel includes Password::uncompromised() in recent versions, which also checks passwords against Have I Been Pwned and may be sufficient if you do not need a separate package. Other options include a custom validation rule around your own breach-check client or a different Composer package. Compare semantics carefully, especially non-string handling, caching, timeout, and fail-open versus fail-closed behavior.