- How do I install and configure Laravel MasterPass?
- Install it as a dev dependency with composer require imanghafoori/laravel-masterpass, publish the package config, and set the master password through an environment variable that exists only in local or staging env files. Then confirm how your auth guard and user provider are wired, because the package typically works by swapping in a custom Eloquent user provider that short-circuits credential validation. Budget about half a day for verification rather than the 15 minutes the README implies.
- Is Laravel MasterPass safe to use in production?
- No. A master password is a single secret that authenticates as every user, including admins, so shipping it to production creates a universal backdoor with no visible symptom if the key leaks into a production .env or a cached config. Treat it as a require-dev tool only, add a runtime guard that ignores the config when app()->isProduction(), and add a CI check that fails if the master-password env key appears in the production config map.
- What is the difference between Laravel MasterPass and laravel-impersonate?
- MasterPass is a credential bypass, not a session-based impersonation flow: it has no impersonated_by session key, no return-to-admin route, and no UI. It makes a configured master password valid for any account, which is useful for QA and seeded demos but gives you no attribution or undo path. If you need human-facing support impersonation with an audit trail, prefer lab404/laravel-impersonate instead.
- Which Laravel and PHP versions does MasterPass support?
- The package requires PHP 8.x and targets modern Laravel releases, but the last tagged release was 2024-06-12, so confirm compatibility with your Laravel major, including Laravel 12, before adopting it. With a single maintainer and zero dependents, do not assume fast upstream fixes for new framework versions. Pin the current minor in composer.lock and test the guard/provider wiring on your target version.
- Does MasterPass work with Sanctum, Passport, or custom guards?
- Coverage is partial: session/Eloquent guards are the happy path, while Sanctum, Passport, multi-tenant provider swaps, and custom guards may silently ignore the package or be mistakenly assumed covered. The safe approach is to test each guard you actually use with the master password and verify whether authentication succeeds, fails closed, or bypasses unexpectedly. Do not rely on the package working uniformly across every guard without empirical confirmation.
- How does Laravel MasterPass work under the hood?
- Despite the impersonation description, MasterPass is a universal credential bypass rather than a session impersonation flow. It treats your configured master password as valid for any user account, typically by swapping in a custom Eloquent user provider that short-circuits validateCredentials(). Confirm the exact mechanism in the version you install, because it determines the blast radius and which guards are covered.
- What happens if the master password config key is missing?
- This is a key fail-closed question to verify empirically in your version. The package should ignore the bypass when the config key is absent, but the assessment flags fail-open behavior as the default risk, so test with the key missing and with a cached config built from a different environment. Add a runtime guard in a service provider rather than relying on the env var being absent.
- Does MasterPass bypass two-factor authentication or login throttling?
- Fortify/Jetstream 2FA and login throttling live in the login pipeline, not in credential validation, so behaviour after a successful master-password check needs empirical confirmation. The package primarily affects credential validation, which means post-authentication middleware and 2FA challenges may still run, or may not, depending on your stack. Test the full login flow rather than assuming the master password skips every security layer.
- Can I restrict Laravel MasterPass to local or staging environments only?
- Yes, but do it in code, not just by convention. Source the password from an env var that exists only in local/staging env files, never in a shared or checked-in .env.example default, and add a hard runtime guard in a service provider that ignores the config entirely when app()->isProduction(). Also add a CI check that fails the build if the master-password env key is set in the production config map.
- Is Laravel MasterPass actively maintained, and what are the alternatives?
- Supply-chain signals are weak: around 369 stars but zero dependents, a single maintainer, and a last release date of 2024-06-12, which means low ecosystem scrutiny and little downstream pressure to keep it current with new Laravel majors. Treat it as a low-momentum dev tool and pin the current minor. For real user impersonation with attribution and an undo path, use lab404/laravel-impersonate; MasterPass is best limited to local development, seeded demos, and QA.