Weave Code
Security Bundle Laravel Package
modera/security-bundle
Modera Security Bundle provides reusable security components for Symfony applications, including user authentication, role-based access control, and integration points for managing permissions in Modera-based projects. It helps centralize security configuration and common access-control workflows.
[READ-ONLY] Provides low level security integration layer for Symfony and a user-groups-permissions Doctrine ORM mapped domain model.
Frequently asked questions about Security Bundle
- Is modera/security-bundle a Laravel package?
- No. It is a Symfony bundle built on the Symfony Security component, shipping a Symfony DI extension for service wiring and Doctrine ORM mappings for its domain model. Laravel has no bundle concept, and its authorization stack is Illuminate\Auth plus Gate and Policy with Eloquent persistence. There is no seam where this package drops into a Laravel application.
- Does modera/security-bundle support Laravel 10 or 11 and PHP 8?
- No Laravel version is supported, and it targets PHP 5.6 through 7.0 with Symfony 2.8/3.x. The last release was 2016-06-10, and its Symfony and Doctrine constraints will not resolve against PHP 8.x without overrides. Forcing those overrides converts clean install failures into runtime fatals, which is a serious red flag on a security-critical dependency.
- What does modera/security-bundle actually do?
- It bundles reusable security components for Symfony applications: user authentication, credential handling, and access control for protected resources. It encodes a Users to Groups to Permissions relational model and centralizes security configuration through a service-oriented setup. The enforcement layer is coupled to Symfony's security context, voters, and firewall listeners.
- Is modera/security-bundle still maintained?
- No, it is abandoned. The repository is a READ-ONLY split-repo marker, the last release is from June 2016, and there is no maintainer response path. It has roughly 3 stars and 0 dependents, so no downstream consumers are exercising edge cases and there is no community CVE response. There is also no disclosure channel, which is a governance blocker on an authentication boundary.
- Can I install modera/security-bundle in a Laravel app with Composer?
- You may be able to require it only if the 2016-era constraints happen to resolve, but nothing will function afterward. Nothing registers the Symfony DI extension in Laravel's container, and the Doctrine entities do not map to Eloquent models. If you need proof for due diligence, run the install in an isolated container rather than in your application's dependency graph.
- What is the Laravel equivalent of modera/security-bundle?
- The native equivalent is Gate and Policy authorization backed by Eloquent relationships, optionally paired with a maintained RBAC package such as spatie/laravel-permission. That package implements the same user-group-permission model in a Laravel-native way and is actively maintained. The durable idea worth borrowing from the bundle is the relational shape, not its enforcement path.
- How do I migrate from modera/security-bundle to Laravel Gate and policies?
- Extract rather than adopt: read the Doctrine mapping to confirm the User, Group, and Permission entity shape, then recreate the schema as Laravel migrations with belongsToMany relations and a pivot-table cache of effective permissions. Enforce access through Gate::before or policies that resolve from the cached permission set instead of walking relations per request. If a legacy Symfony service still runs the bundle, use a strangler pattern with dual-written group and permission assignments and feature-flagged read cutover, routing through a shared data store rather than bridging Symfony's security context into Laravel's.
- Is modera/security-bundle safe to use for production authentication?
- Technical risk here is high. Unmaintained authorization code accumulates silent risk such as outdated hashing defaults, missing timing-safe comparisons, and permission-cache poisoning, and none of it will be patched. With zero downstream validation and no disclosure channel, you would have to fork and own security patching indefinitely if you adopted it. That is not a reasonable posture for an auth boundary.
- How should I evaluate or spike modera/security-bundle before adopting it?
- Treat it as a reference implementation to read, not a dependency to install. Confirm whether the dependency constraint graph resolves at all against your target PHP and framework version, and review the Doctrine mapping plus the enforcement path. Keep any spike in an isolated container and never inside the application's dependency graph.
- What are alternatives to modera/security-bundle for role-based access control?
- For Symfony projects, use the Symfony Security component directly with voters and Doctrine. For Laravel, use Gate and Policy with a maintained package such as spatie/laravel-permission, which covers the same users, groups, and permissions workflow. In both cases the real cost sits in the enforcement path, including permission resolution, caching, and invalidation at the security boundary, and that is exactly what this bundle cannot transfer.
Weaver
How can I help you explore Laravel packages today?