Weave Code
Defender Laravel Package
orchid/defender
Orchid Defender is a Laravel package for sanitizing user input and filtering out malicious content. It provides configurable string cleaning helpers to protect applications from XSS and other injection attacks with minimal setup.
Blacklist and Whitelist
Frequently asked questions about Defender
- What is orchid/defender used for in a Laravel application?
- Orchid Defender provides route-scoped middleware that checks inbound requests against IP, User-Agent, and Referer allow and deny lists. It can log rejected requests and either abort or redirect the response. It is application-layer access control for specific route groups, not a web application firewall, bot mitigation system, or DDoS protection layer.
- How do I install orchid/defender in Laravel?
- Install it with Composer using composer require orchid/defender, then publish its configuration file if the package ships one. Register the middleware alias in your HTTP kernel or bootstrap file and attach it to the route groups you want to protect. Check the pinned tag's source or README before assuming auto-discovery or exact registration steps.
- How do I configure the blacklist and whitelist rules?
- Rules are configured for IP addresses and CIDR ranges, User-Agent strings, and Referer values, typically through a published config file or a shared rule store. Seed allow and deny entries explicitly and document who owns each blacklist entry and how it is removed without a deploy. If you run multiple instances, use a shared store such as Redis or Memcached and decide fail-open versus fail-closed behavior up front.
- Which Laravel versions does orchid/defender support?
- There is no independent documentation or release cadence for this package, so verify the Laravel and PHP constraints in composer.json for the exact tag you intend to pin. Because it ships alongside Orchid Platform, compatibility generally tracks Orchid releases rather than a separate schedule. Pin the package in composer.lock and keep a documented rollback command.
- Does orchid/defender sanitize input or protect against XSS?
- The package description is ambiguous: some text describes HTML and XSS sanitization helpers while the technical assessment describes request-level allow and deny middleware. These are different capabilities with different threat models and integration surfaces. Review the source in the pinned tag before relying on either behavior, and do not put XSS protection in a security narrative until that review is complete.
- Is orchid/defender a WAF or DDoS protection tool?
- No. Orchid Defender is a lightweight middleware for allow and deny decisions at the application layer. It is not a WAF, not rate limiting, not geo-blocking, and not bot mitigation. Treat any roadmap item implying those capabilities as out of scope for this dependency.
- How does orchid/defender resolve the client IP behind a CDN or load balancer?
- It relies on Laravel's request IP resolution, so correct behavior depends on TrustProxies being configured for your CDN, ALB, or nginx setup. Verify that $request->ip() returns the real client address in production before shipping any rules, because misresolution can cause mass lockouts or silent bypasses. Add a probe route and regression tests for proxy headers, IPv6 CIDR matching, and allow-versus-deny precedence.
- What happens if the rule store is unavailable in production?
- The package does not give you an independent guarantee about fail-open or fail-closed behavior when a shared rule store is unavailable. Prove that behavior from source and lock it down with your own tests before relying on it. Also document a break-glass path for removing a bad blacklist entry without a deploy, and test that path regularly.
- How should I test orchid/defender in my Laravel app?
- Write feature tests that send requests with allowed and denied IPs, User-Agent values, and Referer headers, and assert the abort or redirect outcome. Cover IPv6 CIDR matching, allow-versus-deny precedence, proxy header handling, and the rule store unavailable case. Keep these tests pinned to the package version as an upgrade guard, since there is no external test corpus or issue backlog to lean on.
- Is orchid/defender actively maintained, and what are the alternatives?
- There is no independent release cadence; fixes arrive only when Orchid Platform ships them, so pin the package and review it quarterly for abandonment or refactors. Outside an existing Orchid Platform installation, the same logic is roughly 200 lines of middleware you could build and fully test in a few days. Alternatives include custom Laravel middleware, route-level authorization, and dedicated firewall or rate-limiting packages if you need broader protection.
Weaver
How can I help you explore Laravel packages today?