Weave Code
Secure Controller Bundle Laravel Package
leaseweb/secure-controller-bundle
A Symfony bundle that adds declarative security to controllers, letting you enforce authentication and authorization rules with attributes or annotations instead of repetitive boilerplate checks in every action.
Leaseweb Secure Controller Bundle adds declarative, controller-level security to Symfony applications. It lets you protect controller classes or individual actions with attributes/annotations, keeping authorization rules close to the routes they guard while relying on Symfony’s Security component for enforcement.
- Secure whole controllers or specific actions with PHP attributes
- Define role- and expression-based access rules
- Integrate with Symfony security voters and firewalls
- Make public endpoints explicit and easy to audit
- Lightweight, framework-native configuration
Frequently asked questions about Secure Controller Bundle
- Can I install leaseweb/secure-controller-bundle in a Laravel app?
- No. leaseweb/secure-controller-bundle is a Symfony bundle, not a Laravel package. It integrates through a Symfony Bundle class, a DI extension, and a kernel.controller listener, and its Composer constraints target Symfony 2.x/3.x-era framework-bundle and http-kernel. Installing it in a modern Laravel app that pulls Symfony 6/7 components via illuminate/* will fail dependency resolution at best. There is no natural Laravel hook for it to attach to.
- What does leaseweb/secure-controller-bundle do?
- It provides an @Secure annotation for Symfony2 controllers so you can declare required roles and security expressions directly on an action or controller. A listener reads the annotation and enforces it through Symfony Security. The value is less boilerplate: the authorization requirement sits next to the action it protects. It is Symfony-specific and was last released in 2016.
- Does this bundle support Laravel 10, 11, or 12?
- No. The bundle predates Laravel 10/11/12 by years; it targets Symfony 2.7/3.0-era APIs and PHP 5.6/7.0 idioms. Laravel does not dispatch controllers through Symfony's kernel.controller event, so the enforcement mechanism has no seam. Use Laravel's native can: middleware, Gate, or a custom attribute instead.
- Is leaseweb/secure-controller-bundle still maintained?
- Effectively no. The last release was 2016-03-08, it has about 14 stars and zero dependents, which suggests a single-vendor internal tool. Nobody downstream is absorbing breakage or reporting defects. Owning it for a security control means owning an unmaintained security-adjacent component.
- Why is docblock annotation-based security risky?
- Docblock-driven authorization is fail-open by nature. A malformed annotation, a renamed method, a stripped docblock from opcache, a minifier, or a code generator, or an action the reader never visits leaves the route unprotected with no error. For a security control that is the worst failure mode. Prefer attributes and a fail-closed middleware that denies by default.
- How do I secure controller actions with roles in Laravel instead?
- Use route middleware such as ->middleware('can:manage-users') or Route::can() in Laravel 11+, plus Gate and Policy classes for the underlying checks. If you need per-action granularity on one controller, add a custom PHP 8 attribute such as #[RequiresRole('admin')] and a middleware that reads it. Laravel's authorization layer is already fail-closed when you use Gate::authorize or $user->can and abort on false.
- How do I build a #[RequiresRole] attribute and middleware in Laravel?
- Define a PHP 8 attribute, for example #[RequiresRole('admin')], and apply it to controller methods. Write an EnforceActionRoles middleware that reflects the route's controller method, reads the attribute, then calls Gate::authorize or $user->can and aborts with 403 otherwise. Register it as global or group middleware and keep it fail-closed: baseline auth still applies, and public actions need an explicit opt-out attribute. This is roughly 50 to 100 lines plus tests.
- What Laravel alternatives replace @Secure annotations?
- The native options are can: middleware per route, Route::can in Laravel 11+, Gate and Policy classes, and $this->authorize in controllers. For role management, spatie/laravel-permission is the common choice. A small custom attribute plus middleware is the direct replacement for the @Secure pattern. None of these require the Symfony bundle.
- Does this package work with PHP 8.2 and Symfony 7?
- No. The bundle uses doctrine/annotations 1.x and Symfony 2.x/3.x line constraints, while modern Laravel runs Symfony 6/7 components. doctrine/annotations v1 is deprecated and docblock annotation scanning was dropped in Symfony 7. Target PHP 8.2+, Laravel 11/12, and PHP attributes only if you reimplement the pattern.
- How much effort is porting this bundle's pattern to Laravel?
- Less than porting or vendoring the bundle. Reimplementing the concept is about 50 to 100 lines plus tests: one attribute class and one middleware. Porting means replacing the Bundle class, DI extension, kernel.controller listener, and Doctrine annotation reader with Laravel equivalents, which is strictly more work. Adopt the pattern, not the package.
Weaver
How can I help you explore Laravel packages today?