Weave Code
Guard Laravel Package
knpuniversity/guard
KnpUniversity Guard adds simple, flexible guard-based authentication to Symfony. Define a guard class to handle credentials, user loading, success or failure, and token creation, making custom login flows and API authentication easier.
Simple and lovely Symfony authentication
Frequently asked questions about Guard
- Does knpuniversity/guard work with Laravel?
- No. It is a Symfony bundle that registers compiler passes and security listeners against Symfony Security components, and Laravel does not expose or emulate those abstractions. There is no service provider, facade, or Auth::extend hook to integrate with. Use Laravel's native guard and user-provider system instead.
- Can I install knpuniversity/guard in a Laravel 10 or 11 app with Composer?
- No, Composer constraint resolution will fail because the package requires a PHP 5-era Symfony version. Forcing it with --ignore-platform-reqs or a vendored fork still leaves code that cannot bootstrap without a Symfony kernel, container, and event dispatcher. A forced install is a platform-requirement bypass and should be treated as a security red flag.
- What is knpuniversity/guard used for?
- It backports Symfony's Guard authentication system to Symfony 2.6 and 2.7 applications. You implement a single GuardAuthenticator per firewall to extract credentials, load users, create tokens, and control success or failure responses. It was designed for custom form login, API tokens, HTTP basic, and social authentication in Symfony, not Laravel.
- Is knpuniversity/guard maintained and safe for production authentication?
- No. The repository is archived, has no release since September 2015, zero dependents, no maintainer, and no security-advisory channel. Authentication is the highest-consequence surface in an application, so adopting it means owning an unmergeable fork of credential-handling logic with sole CVE-triage responsibility. It should not pass a modern third-party security review.
- What Laravel authentication alternatives replace knpuniversity/guard?
- Use Laravel's native guards and user providers for custom flows, Sanctum or Passport for API tokens, Fortify for login and two-factor scaffolding, and Socialite for social login. Breeze or Jetstream can provide starter scaffolding. These are first-party, maintained options that cover the same use cases.
- How do I build a custom login flow in Laravel without this package?
- Implement a custom guard via Auth::extend and a user provider via Auth::provider, or use Laravel's built-in session guard with a custom Eloquent provider. Put credential extraction and validation in a dedicated service or action class, then branch on success or failure in your controller or middleware. Fortify is the supported path if you want framework-provided login, registration, and two-factor flows.
- Does the GuardAuthenticator pattern transfer to Laravel?
- The design pattern transfers, but the PHP code does not. The useful sequence is to extract credentials from the request, build an unauthenticated token, validate against a user provider, branch on success or failure, and expose a challenge entry point. In Laravel, implement that sequence with Illuminate\Contracts\Auth\Guard, Auth::extend, and middleware rather than Symfony Security interfaces.
- Which Symfony versions does knpuniversity/guard support?
- It targets Symfony 2.6 and 2.7, backporting Guard before it shipped natively in Symfony 2.8. It was later superseded again by AuthenticatorInterface in Symfony 5.3 and newer. There is no Laravel compatibility matrix and none could exist.
- Can knpuniversity/guard handle API token or social login?
- In its intended Symfony 2.6 and 2.7 context, a GuardAuthenticator can handle API tokens, HTTP basic, form login, or social authentication per firewall. In Laravel it cannot run at all because the Symfony Security runtime is absent. Use Sanctum or Passport for API tokens and Socialite for social login instead.
- How should I test a custom Laravel guard or authenticator?
- Use PHPUnit or Pest feature tests with Laravel's actingAs helper for authenticated paths, and unit-test your credential extraction and user-provider logic in isolation. Cover success, failure, challenge, and remember-me branches explicitly. For stateless API tokens, assert both valid and revoked token behavior.
Weaver
How can I help you explore Laravel packages today?