Weave Code
Serializable Closure Laravel Package
laravel/serializable-closure
Securely serialize and unserialize PHP closures with Laravel’s fork of opis/closure 3.x, updated for modern PHP without requiring FFI. Wrap closures in SerializableClosure, set a secret key for signing, serialize safely, then restore with getClosure().
Laravel Serializable Closure provides an easy and secure way to serialize closures in PHP.
Frequently asked questions about Serializable Closure
- How do I securely serialize closures in Laravel for queue jobs or cached middleware?
- Use `SerializableClosure` by wrapping your closure, setting a secret key with `SerializableClosure::setSecretKey()`, then serializing/unserializing it. This ensures tamper-proof execution and works seamlessly with Laravel’s queue system or cache drivers.
- Does this package support Laravel 12/13 and PHP 8.5+ features like constant expressions?
- Yes, this package is fully compatible with Laravel 12/13 and PHP 8.5+. It supports modern PHP features like constant expressions, virtual properties, and enums while avoiding FFI dependencies that could break in web requests.
- What’s the difference between this and `opis/closure` 4.x, and why should I use Laravel’s fork?
- Laravel’s fork is based on `opis/closure` 3.x and avoids the FFI dependency in 4.x, which isn’t enabled by default in web environments. It’s optimized for Laravel’s ecosystem, supports PHP 8.5+, and includes fixes for edge cases like anonymous migrations.
- Can I use this to serialize closures in Eloquent model observers or Laravel tasks?
- Absolutely. This package is ideal for stateful closures in observers, tasks, or event listeners. Just wrap the closure in `SerializableClosure`, set a secret key, and serialize it—it preserves the closure’s captured variables and context.
- How do I handle the secret key securely in production?
- Never hardcode the secret key. Use Laravel’s `.env` file or `config()` method to store it securely. Rotate keys periodically and ensure they’re not exposed in version control or logs.
- Will this work with Laravel’s cache system (e.g., `Cache::put()`) for storing serialized closures?
- Yes, it integrates perfectly with Laravel’s cache. Serialize the `SerializableClosure` object and store it in cache—just ensure the secret key is consistent across cache reads/writes to maintain security.
- Are there performance concerns when serializing closures in high-throughput systems like queue workers?
- Serialization adds minor overhead, but it’s negligible for most use cases. Benchmark in your specific environment, especially if processing thousands of closures per second. For critical paths, consider caching or lazy-loading.
- What happens if I serialize closures defined in the same line or REPL environments like Laravel Tinker?
- Closures defined on the same line with identical signatures may collide during deserialization. Avoid REPL environments entirely—this package isn’t designed for dynamic runtime definitions like Tinker.
- Can I migrate from `opis/closure` to this package without breaking changes?
- Yes, but audit your code for custom serialization logic. Replace `serialize($closure)` with `serialize(new SerializableClosure($closure))` and ensure the secret key is set. Test thoroughly, especially for edge cases like nested closures.
- Does this package support PHP 7.4+ but lose features in newer PHP versions?
- No, it’s actively maintained for PHP 7.4+ and gains support for newer features (e.g., PHP 8.5’s constant expressions). However, test custom use cases like attributes or enums to ensure compatibility.
Weaver
How can I help you explore Laravel packages today?