- How do I install marshmallow/ip-access in a Laravel app?
- Install it with composer require marshmallow/ip-access, publish the package config, register the middleware in your Laravel HTTP kernel or route group, and set your allowlist via config or IPACCESS_WHITELIST. As of 2.8.0, non-Nova applications no longer need Laravel Nova installed. Clear cached config after deployment so the new rules take effect.
- Does marshmallow/ip-access support CIDR ranges and single IP addresses?
- Yes. The package is designed for IP-based access control using configurable allowlists and denylists, and it supports both individual IP addresses and CIDR ranges. Rules are applied through Laravel middleware so you can centralize filtering for routes or route groups.
- How do I protect Laravel routes with IP allowlist middleware?
- Register the package middleware in your Laravel HTTP kernel or as a route middleware alias, then attach it to the routes or groups you want to protect. Configure the allowlist and denylist in the published config or through IPACCESS_WHITELIST. Requests that fail the rules are blocked, and you should verify your expected 403 behavior in tests.
- Is Laravel Nova required to use marshmallow/ip-access?
- No. In 2.8.0 the package moved laravel/nova from a hard dependency to suggest, so a standard Laravel install no longer pulls Nova transitively. The bundled Nova resource is opt-in; Nova consumers must explicitly require laravel/nova in the root application and ensure the resource is registered or discovered. Non-Nova API and worker-adjacent services avoid an unnecessary admin-panel dependency.
- How do I upgrade from marshmallow/ip-access 2.7.x to 2.8.0 without breaking Nova admin?
- Run the normal Composer update, but first audit your lock file for laravel/nova and confirm whether your application uses the bundled Nova resource. If it does, add laravel/nova explicitly to your root require block, verify resource registration or discovery, and test the admin path. Clear cached config and package discovery after deploy, and test fresh installs separately from upgraded lock files because Composer resolution can differ.
- Does marshmallow/ip-access work correctly behind load balancers or proxies?
- The package performs application-level IP filtering, so correct client IP resolution depends on Laravel's trusted proxy configuration and middleware ordering. Behind a load balancer, make sure trusted proxies are configured before the IP access middleware evaluates the request. This is not a replacement for edge, WAF, or network-level filtering.
- What Laravel and PHP versions does marshmallow/ip-access support?
- The provided assessment does not specify exact Laravel and PHP version constraints, so check the package composer.json and its CI matrix before upgrading. It is anchored on v2.8.0, and the release focus is the Nova dependency change rather than middleware behavior. Confirm whether CI covers both with-Nova and without-Nova installs for your target versions.
- How can I test IP allowlist and denylist behavior in CI?
- Test the middleware with simulated requests from allowed and denied IPs, including CIDR boundary cases, and assert the expected allow and 403 responses. For 2.8.0, run CI in two modes: one with Nova installed and one without Nova installed. Also verify config publishing, middleware registration, IPACCESS_WHITELIST parsing, and behavior after config caching.
- What are alternatives to marshmallow/ip-access for Laravel IP filtering?
- Alternatives include writing custom Laravel middleware, relying on trusted proxy and web server rules, or using edge/WAF controls for network-level filtering. marshmallow/ip-access is a fit when you want framework-native, centralized application IP rules with CIDR support and middleware-driven enforcement. It is not intended as an edge or WAF replacement.
- Is marshmallow/ip-access maintained and safe for production Laravel applications?
- The assessment rates technical risk as low overall for standard Laravel HTTP applications, with the main caveat being Nova consumers who must now declare laravel/nova explicitly. Non-Nova users get a smaller maintenance surface because Nova is no longer installed or upgraded transitively. Before production, verify the package bootstraps cleanly without Nova if you do not use it, confirm middleware ordering relative to trusted proxies, and test allow/deny behavior in CI.