Security Laravel Package

Product Decisions This Supports

• Accelerates secure authentication rollouts for Laravel applications by providing a pre-built, battle-tested RBAC/ACL solution that reduces development time by ~60% compared to custom implementations. Aligns with roadmap items requiring role-based permissions (e.g., admin dashboards, multi-tenant systems).
• Strengthens compliance posture with fixes for session expiration logic (v3.2.3/v3.2.4), addressing gaps in audit trails for GDPR/HIPAA requirements. The persistIdentity flag (v3.2.4) enables granular control over post-logout data retention, critical for privacy-focused applications.
• Build vs. Buy: Justifies buying over building for teams lacking security expertise. The package’s PHPStan integration and static analysis reduce long-term maintenance costs by enforcing security best practices (e.g., sensitive parameter marking via #[\SensitiveParameter]).
• Key use cases:
  • Multi-role systems (e.g., SaaS platforms with admin/user/customer tiers).
  • Legacy Laravel apps migrating from custom auth to a standardized RBAC model.
  • High-assurance features (e.g., payment gateways, healthcare portals) where session integrity is non-negotiable.

When to Consider This Package

• Adopt when:
  • Your Laravel app requires RBAC/ACL but lacks dedicated security resources.
  • You need session security fixes (e.g., preventing silent revalidation of expired sessions) without rewriting auth logic.
  • Your team prioritizes static analysis (PHPStan) to catch security flaws early.
  • You’re building a compliance-heavy application (e.g., finance, healthcare) where session behavior must align with regulatory standards.
  • You’re using Laravel 9+ and can tolerate minor dependency conflicts (e.g., nette/utils vs. Laravel’s illuminate/support).
• Look elsewhere if:
  • You’re heavily invested in Laravel’s native auth (Fortify, Sanctum, Breeze) and need deep integration.
  • Your app requires custom session storage (e.g., database-backed sessions) beyond the package’s defaults.
  • You lack PHP 8.1+ (minimum requirement for v3.2.0+).
  • Your stakeholders demand native Laravel middleware support (this package is framework-agnostic).

How to Pitch It (Stakeholders)

For Executives: "This package lets us deploy role-based access control in weeks instead of months, cutting dev costs while locking down security. The latest update fixes a critical session bug—expired sessions now stay expired, reducing compliance risks. It’s a low-risk, high-reward choice for projects needing admin dashboards, multi-tenancy, or regulated data access."

For Engineering: "v3.2.4 adds guest identity support (e.g., anonymous users with roles) and tightens session security, but it’s still not a drop-in for Laravel. If we’re okay with minor dependency tweaks, it’s a solid RBAC solution. Tradeoffs: No native Laravel middleware, but the tradeoff is worth it for audit-ready session handling. Pro tip: Use it alongside Laravel’s auth() helper for hybrid setups."

For Security Teams: "The persistIdentity flag (v3.2.4) gives us granular control over post-logout data retention, critical for GDPR. PHPStan integration ensures we catch sensitive parameter leaks early. Warning: This isn’t a replacement for Laravel’s auth—it’s a complement for RBAC/ACL needs."