Weave Code
Serializable Closure Laravel Package
laravel/serializable-closure
Securely serialize and unserialize PHP closures with Laravel’s fork of opis/closure 3.x, updated for modern PHP without requiring FFI. Wrap closures in SerializableClosure, set a secret key for signing, serialize safely, then restore with getClosure().
Laravel Serializable Closure provides an easy and secure way to serialize closures in PHP.
Frequently asked questions about Serializable Closure
- How do I securely serialize closures for Laravel queues (e.g., Bus::chain or delayed jobs)?
- Use `SerializableClosure` to wrap your closure, then serialize it with `serialize()`. Set a strong secret key via `SerializableClosure::setSecretKey()` to prevent tampering. This works seamlessly with Laravel’s queue system, including delayed jobs and chained jobs. Always store the serialized output in a queue payload or cache.
- Can I use this package to store closures in Redis or Memcached for later execution?
- Yes, this package is perfect for caching closures in Redis or Memcached. Serialize the `SerializableClosure` object and store it as a string. When retrieving, unserialize and call `getClosure()` to execute it. Ensure your secret key is securely managed (e.g., via Laravel’s `.env` or Vault).
- What Laravel versions and PHP versions does this package support?
- This package is compatible with Laravel 10+, 11, 12, and 13, and requires PHP 7.4+. For modern Laravel apps (12/13), use PHP 8.4 or 8.5. Check the [Packagist page](https://packagist.org/packages/laravel/serializable-closure) for the latest version compatibility. Avoid PHP <7.4 due to unsupported features.
- How do I set the secret key for signing serialized closures?
- Call `SerializableClosure::setSecretKey('your_secure_key_here')` in your application’s bootstrap (e.g., `bootstrap/app.php` or a service provider). Store the key in an environment variable (e.g., `.env`) or Laravel Vault for security. Rotate keys periodically and handle existing serialized closures carefully during rotation.
- Will this work with Laravel’s event listeners or dynamic middleware?
- Absolutely. Serialize closures for event listeners (e.g., `Event::listen`) or middleware logic to store them in caches or queues. For example, serialize a closure for a delayed event listener and restore it later. Just ensure the closure’s dependencies (e.g., class instances) are available when deserialized.
- Is there a performance overhead when serializing/deserializing closures?
- Yes, serialization adds CPU overhead, but it’s minimal for most use cases. Benchmark in staging to assess impact. For performance-critical paths, cache the serialized closures (e.g., in Redis) to avoid repeated serialization. Avoid serializing closures in tight loops or high-frequency operations.
- Can I use this package in Laravel Tinker or REPL environments?
- No, this package does not support REPL environments like Laravel Tinker. Serialization in REPL contexts can lead to unpredictable behavior or errors. Restrict usage to non-interactive contexts like HTTP requests, CLI commands, or queue workers.
- What happens if I don’t set a secret key? Are serialized closures still secure?
- Without a secret key, serialized closures are vulnerable to tampering or injection attacks. The package enforces signing by default, but you must explicitly set a key. Always configure `SerializableClosure::setSecretKey()` in production. Treat the key like a cryptographic secret (e.g., store it in `.env` or Vault).
- Are there alternatives to this package for simpler use cases?
- For basic serialization, Laravel’s built-in `serialize()` may work, but it lacks security features like signing. The `opis/closure` package (FFI-based) is another option, but it requires FFI support (not enabled by default in web requests). This package is a Laravel-optimized fork of `opis/closure 3.x` without FFI dependencies.
- How do I test closures after deserialization in CI or unit tests?
- Test deserialized closures by mocking the `SerializableClosure` object or using real closures in test cases. Avoid REPL-like environments in CI. For Laravel-specific tests, simulate queue jobs or event listeners by serializing closures and verifying their output. Use PHPUnit’s assertions to validate closure execution results.
Weaver
How can I help you explore Laravel packages today?