- Can I use evozon-php/simple-bruteforce-bundle in a Laravel application?
- No. It is a Symfony bundle, not a Laravel package. Its integration depends on AppKernel bundle registration, a DI Extension and CompilerPass, and subscribers to Symfony Security's security.authentication.failure and security.authentication.success events. Laravel has no bundle loader or compiler pass pipeline and does not emit those events, so none of the wiring transfers.
- Does this package support Laravel 10 or Laravel 11?
- There is no Laravel version support. The package targets Symfony 3-era projects and will constrain symfony/* to ^2.8|^3.0 with old PHP constraints. Current Laravel majors resolve Symfony 6 and 7 components, so installing it would force an untested dependency combination. Do not use --ignore-platform-reqs to install a security control.
- How do I install SimpleBruteForceBundle with Composer?
- You can install it with Composer in a Symfony 3 application and register the bundle in AppKernel, but that path does not apply to Laravel. For Laravel there is no package install path because there is no service provider or bundle loader. The realistic option is to treat the repository as a design reference and implement the behavior natively.
- How does SimpleBruteForceBundle store and count failed login attempts?
- The overview does not specify the storage backend. It may use a cache pool, Doctrine ORM, or in-memory storage, and that matters for lockout guarantees under horizontal scaling. You need to check composer.json, the DI configuration, and the attempt-key construction, whether IP-only, username-only, or composite, before relying on it. Also confirm whether X-Forwarded-For is trusted and whether failures are fail-open or fail-closed.
- What is the best way to add brute-force protection to Laravel?
- Use Laravel's built-in primitives: Illuminate\Cache\RateLimiter over a shared store such as Redis, the throttle middleware where appropriate, and an Illuminate\Auth\Events\Failed listener or auth middleware to record attempts. Implement the same algorithm the bundle uses: count attempts keyed by identifier, fixed window, lockout threshold, and decay TTL. That is roughly 100 lines of code and an estimated 1–3 engineer-days including tests.
- Is SimpleBruteForceBundle still maintained and safe for production?
- Treat it as unmaintained. Symfony 3.4 reached end of security support in November 2018, so a bundle targeting that line has had no framework security patching for roughly seven years. Brute-force protection sits directly in the authentication path, and unmaintained code there is a standing audit finding regardless of whether the current code is correct. There are also zero validation signals: no stars, no dependents, and no evidence of peer review.
- Is SimpleBruteForceBundle compatible with PHP 8?
- PHP 8 compatibility is unknown and should be assumed risky. This is Symfony 3-era code, and nullable-type, dynamic-property, and string and array function signature changes across PHP 7 to 8 are common breakage points. Verify the exact php constraint in composer.json and run a full test suite on PHP 8 before considering it. For a Laravel app, the dependency resolution conflict makes this moot.
- Will SimpleBruteForceBundle work across multiple servers or behind a load balancer?
- It depends on the storage backend, which the overview does not state. If attempts are stored in a Doctrine entity or a filesystem cache adapter, the lockout guarantee can degrade silently when you run multiple app servers. A shared Redis or database-backed store is required for consistent throttling. You also need to know whether the bundle fails open or fails closed when storage is unavailable.
- Does SimpleBruteForceBundle include tests, a permissive license, and any known CVEs?
- The overview provides no evidence of tests, license terms, or CVE history, and the repository shows no stars or dependents. Before any further evaluation, confirm the last commit date, whether the repo is archived, whether the license is MIT and policy-compatible, and whether any CVE has been filed against it or its dependency tree. Also check for a maintained fork or successor from the same vendor.
- What are the alternatives to SimpleBruteForceBundle for Laravel login throttling?
- For Laravel, use the framework's own rate limiting rather than a Symfony bundle. Laravel ships RateLimiter, the throttle middleware, and authentication events that let you count failures and lock out identifiers with a decay TTL. If you want a maintained package, evaluate Laravel-first authentication scaffolding such as Fortify, but the core primitives are usually enough. Porting this bundle's algorithm into a middleware plus listener is the cleanest migration path.