- How do I install mlocati/ip-lib in a Laravel project with Composer?
- Install it with Composer by running composer require mlocati/ip-lib in your Laravel project. There is no Laravel service provider to register because the package is framework-agnostic. In application code, rely on Composer autoloading and import the library classes directly.
- Does mlocati/ip-lib support Laravel 10 and Laravel 11?
- mlocati/ip-lib does not target a specific Laravel major version, so Laravel 10 and 11 can use it as long as your PHP version satisfies the package's Composer constraints. It has no service provider, facade, or framework coupling, which keeps Laravel upgrades independent of the IP library. Check the package composer.json for the exact PHP floor before adopting it.
- Do I need a service provider or config file to use mlocati/ip-lib in Laravel?
- No. There is no service provider, facade, configuration file, or migration to publish for Laravel. You call the library directly from validation rules, middleware, authorization checks, jobs, or service classes. If you want centralized configuration, create your own Laravel config or wrapper around it.
- How do I validate IPv4 and IPv6 addresses with mlocati/ip-lib in Laravel?
- Parse the submitted value with the library's address factory or parser and treat a null result as invalid. In a Laravel custom validation rule, return false when parsing fails, and optionally check the address family or subnet membership. This gives stricter control than a loose regex and supports both IPv4 and IPv6.
- How do I check whether an IP address belongs to a CIDR subnet or range?
- Parse the IP address and the CIDR subnet or explicit start-end range, then call the range's contains method with the address object. Normalize both inputs first so IPv4-mapped IPv6 and mixed formats do not produce unexpected results. This pattern works for allowlists, tenant ranges, and request-source checks.
- Does mlocati/ip-lib throw exceptions on invalid IP input?
- No. The library's string parsing methods return null for invalid input rather than throwing exceptions. Your Laravel code must explicitly handle null, for example by failing validation or rejecting the request, or you risk null-dereference bugs. This is especially important at trust boundaries such as forwarded headers.
- Can mlocati/ip-lib handle wildcard ranges and IPv4-mapped IPv6 addresses?
- Yes. mlocati/ip-lib supports wildcard ranges, CIDR subnets, explicit ranges, and IPv4-mapped IPv6 addresses. Use version 1.22.1 or newer because it fixes defects in pattern serialization for IPv4-mapped IPv6 and in subnet pattern end addresses. Test wildcard and mapped-address cases against your own allowlist semantics.
- How should I normalize IP addresses for audit logs and database storage?
- Parse each address, convert it to a canonical string or binary form, and persist one consistent representation. Decide explicitly how IPv4-mapped IPv6 addresses should be normalized before storage, because mixed formats complicate queries and audit comparisons. Apply the same normalization at ingestion and when evaluating allowlists.
- Is mlocati/ip-lib safe for trusted proxy and X-Forwarded-For handling?
- It is useful for evaluating whether a proxy or client IP belongs to a trusted CIDR range, but it does not define your trust boundary. Configure Laravel TrustProxies correctly in every environment and only parse forwarded headers from proxies you actually trust. Treat parsing nulls and malformed headers as untrusted input.
- Which version of mlocati/ip-lib should I pin in production?
- Pin at least 1.22.1 because earlier releases could accept trailing newlines in IP strings and had IPv4-mapped IPv6 serialization defects. A floating ^1.22 constraint is not enough if policy requires avoiding known parsing leniency. Also verify provenance and consider an internal mirror, since the package is maintained by a single maintainer.