- What is dskripchenko/laravel-admin used for, and how does it compare with Filament or Nova?
- It is a Laravel admin panel constructor for building resource-first CRUD screens quickly, with forms, tables, filters, admin routing, a Vue 3 SPA, and JSON API transport. It is aimed at back-office management and configuration screens that drop into an existing Laravel app. Filament, Nova, and Backpack are broader admin frameworks with their own ecosystems, so choose based on your team's need for resource-first CRUD versus a larger prebuilt admin suite.
- How do I install dskripchenko/laravel-admin in a Laravel app?
- Install it with Composer using the package constraint, then run composer update and follow the README for service provider or asset steps. If the release publishes configuration, run vendor:publish and diff the published file against your app's config rather than overwriting it blindly. For v1.51.1 no data migration is anticipated, but confirm CACHE_STORE is shared before production.
- Which Laravel versions does laravel-admin support?
- The technical assessment describes the target fit as Laravel 10 and 11-era applications. The package's Composer metadata and README are the authoritative source for exact Laravel and PHP constraints. Check those constraints before planning an upgrade, especially for older Laravel releases.
- Does laravel-admin change my application's routes or authentication?
- The package is positioned to drop into a Laravel app without requiring changes to your routes or auth. The v1.51.1 fix does touch the session-teardown path for the SPA shell, API, and bootstrap endpoints when that auth flow is in use. Review the published config and session behavior if your app relies on that path.
- How do I build CRUD screens with resource-first laravel-admin?
- Define resources that describe the model, fields, forms, tables, and filters, then let the package render the admin screens and JSON API endpoints. This resource-first approach reduces repeated controller and view code for standard back-office CRUD. Start with one simple resource, confirm routing and authorization behavior, then expand to related resources.
- What changed in v1.51.1 and should I upgrade from v1.51.0?
- v1.51.1 closes a correctness hole in session teardown by adding a cache-backed denylist of ended session IDs. The defect is live and user-visible for teams on v1.51.0 because sign-out now reloads the page, so treat the patch as urgent rather than routine. No schema migration or config signature change is described, but the new Auth\EndedSessions class enters the public namespace, so confirm its binding and overridability and review any new config keys.
- What cache store does the ended-session registry require in production?
- Use a shared, durable cache such as Redis or Memcached reachable from every web and worker node. File and array stores are unsuitable for multi-node deployments because the check can pass or fail depending on which node serves the request. Also confirm CACHE_PREFIX is unique per environment or tenant and verify whether session IDs are hashed and cache keys namespaced.
- How should the ended-session cache TTL relate to session lifetime?
- The registry TTL must outlive the session it is protecting; if cache eviction or TTL is shorter than session lifetime, the sign-out-undo window reopens silently. Verify how the TTL is derived and make sure it cannot be configured downward by accident. Treat any shortening as a security-sensitive change.
- What happens if the cache is down during ended-session validation?
- The assessment describes fail-open behavior, meaning a cache outage skips the check and restores the exact sign-out bug the release fixes. That is an availability-over-security trade-off, so document it, alert on it, and confirm whether the behavior is configurable. The skipped-check path should emit a log line or counter so operators can tell protection is disabled.
- How should I test sign-out and session replay behavior in laravel-admin?
- Test signing out, then replaying the same session ID against the API, bootstrap, and SPA shell endpoints and assert that a fresh session is issued. Cover multiple tabs, long-lived polling, API-token and remember-me paths if they exist, and run with a shared cache rather than array or file. Add a test for cache failure or eviction so the fail-open behavior is visible.