Weave Code
Security Laravel Package
nette/security
Security utilities for Nette apps: authentication and authorization helpers, user identity and roles, access control checks, and related infrastructure for building secure login flows and protecting resources with a consistent API.
🔑 Provides authentication, authorization and a role-based access control management via ACL (Access Control List)
Frequently asked questions about Security
- Can I use nette/security for Laravel’s authentication system instead of Laravel’s built-in auth?
- Technically yes, but it requires significant effort. nette/security’s DI and session systems clash with Laravel’s defaults, so you’d need custom middleware, service providers, and session bridges. For most projects, Laravel’s native auth or spatie/laravel-permission is a lower-friction alternative.
- How do I integrate nette/security’s ACL into Laravel’s middleware stack?
- You’ll need to create Laravel middleware that wraps nette/security’s Authorizator class. For example, a `CheckPermission` middleware could use `authorizator->isAllowed($user, $resource, $privilege)` and throw Laravel’s `AuthorizationException` if denied. This requires translating Nette’s IRequest/IResponse to Laravel’s Request/Response.
- Does nette/security support Laravel’s session drivers (Redis, database) out of the box?
- No, it defaults to PHP’s native sessions. You’d need to build a custom `SessionStorage` adapter that bridges Laravel’s session manager (e.g., `Illuminate/Session`) to nette/security’s expectations. This is a high-effort task but doable with a service provider.
- What Laravel versions are compatible with nette/security v3.x?
- nette/security v3.x requires PHP 8.1+, which aligns with Laravel 9+. However, integration friction exists due to DI and middleware differences. Test thoroughly with your Laravel version, as some Nette features (e.g., event system) may need facades or adapters.
- How does nette/security handle password hashing compared to Laravel’s bcrypt?
- nette/security uses modern BCrypt with dynamic algorithms (since v3.2.1), matching Laravel’s security standards. You can reuse Laravel’s `Hash` facade for compatibility, but ensure your `Authenticator` is configured to validate against nette/security’s `PasswordHasher` or Laravel’s `Hasher` interchangeably.
- Is there a quick way to test nette/security in Laravel without full integration?
- Yes, start with a minimal setup: register the `User` and `Authenticator` classes via a Laravel service provider, mock the session storage, and test authentication flows in isolation. Use PHPUnit to verify `Authorizator` checks (e.g., `isAllowed()`) before tackling middleware or events.
- Can I mix nette/security’s RBAC with Laravel’s native auth (e.g., use nette for roles but Laravel for login)?
- Yes, this is a common hybrid approach. Use Laravel’s auth for sessions/tokens and nette/security’s `Authorizator` for role-based checks. Share the user model between both systems via a facade or service binding, but expect edge cases in session synchronization.
- What’s the best way to handle guest users in Laravel with nette/security?
- nette/security v3.2.4 introduces guest identity support via `GuestUser`. In Laravel, bind this to your `AuthManager` and use middleware like `auth:guest` to redirect or apply logic. Ensure your `Authorizator` respects guest roles (e.g., `isAllowed(GuestUser::class, ...)`).
- Are there performance concerns with nette/security in Laravel production?
- Minimal, if configured correctly. Benchmark session storage (e.g., Redis vs. database) and cache `User::refreshStorage()` calls. The main overhead comes from DI adapters or middleware wrappers—optimize these early. nette/security’s ACL checks are lightweight for typical use cases.
- What alternatives should I consider if nette/security’s integration is too complex?
- For RBAC/ACL, prioritize `spatie/laravel-permission` (lower effort) or Laravel’s native `Gate`/`Policy` system. For advanced auth flows, evaluate `laravel/breeze` or `laravel/sanctum` for session management. Only choose nette/security if its compliance features (e.g., GDPR session fixes) or guest identity model are non-negotiable.
Weaver
How can I help you explore Laravel packages today?