rappasoft/lockout
Laravel Lockout is a simple package that locks user accounts after a configurable number of failed login attempts, helping protect applications from brute-force attacks. It includes middleware, events, and customizable lockout behavior for Laravel authentication.
Architecture fit: This is a Laravel application-level maintenance-mode/access-control package: middleware/service-provider integration, CIDR allowlisting, route exclusions, and enable/disable commands. It fits Laravel monoliths and APIs where teams want finer control than framework maintenance mode or edge-only toggles. It should complement, not replace, load balancer/WAF maintenance controls. v6.1.0 improves Laravel 13 compatibility, IPv6 CIDR matching, bundled maintenance view publishing, literal route matching, named/API route detection before global middleware, malformed CIDR handling, and atomic enable/disable persistence.
Integration feasibility: Straightforward for a Laravel team: Composer install, publish/verify config and maintenance view, register middleware, configure allowed CIDRs/routes, and use the enable/disable commands. Laravel 11/12 require PHP 8.2+; Laravel 13 requires PHP 8.3+; tested through PHP 8.5. The suite passes 86 tests/184 assertions across 11 PHP/Laravel combinations. No breaking changes are stated versus v6.0.0, but behavior fixes around route detection and command persistence should be validated in staging.
Technical risk: Laravel 11 is outside security support; production should use patched Laravel 12 or 13. Enable/disable commands mutate the active environment file, so deployment permissions and APP_READ_ONLY sourcing matter. Config caches and long-running workers/Octane must be refreshed after toggles. Route-detection fixes may change which named/API/literal routes bypass maintenance, so access decisions need regression testing. IPv6 CIDRs need explicit test coverage. Laravel 11 with PHP 8.5 has two upstream Testbench deprecations, which should not affect production policy but complicate CI.
Key questions: Is the target app single-node, multi-node, autoscaling, serverless, or Octane-based? Is the environment file the source of truth, or is APP_READ_ONLY injected externally? Who is authorized to run enable/disable commands? How are allowlisted CIDRs and excluded routes governed? What observability exists for maintenance-state divergence? What is the rollback path if persistence or route detection behaves unexpectedly?
Stack fit: Prefer Laravel 12 or 13 on PHP 8.2+/8.3+ respectively. Treat Laravel 11 support as transition-only. Confirm the runtime matches the tested matrix and that Octane/worker restart procedures are documented.
Migration path: From v6.0.0 to v6.1.0 appears to be a minor upgrade, but stage it because route matching and command persistence behavior changed. If currently on Laravel 11, sequence a framework/PHP upgrade before or alongside this package update. If the bundled maintenance view was customized, re-test publishing/loading after upgrade.
Compatibility: The package retains Laravel 11/12 support and adds Laravel 13. --clear-cache remains accepted for existing scripts. Deployments using config caches must rebuild them after enabling/disabling; long-running workers and Octane processes must be restarted. External APP_READ_ONLY values must be updated through deployment tooling, not assumed to be command-managed.
Sequencing: Upgrade Laravel/PHP first; install v6.1.0 in staging; publish and verify config/view assets; wire middleware and allowed CIDRs; test IPv4 and IPv6 matching; test named, API, literal, and global-middleware route scenarios; validate enable/disable success and failure under real file permissions; update config-cache and worker-restart runbooks; canary in non-production; deploy to production with monitoring and rollback ready.
Maintenance: The release shows active maintenance and broad compatibility testing, but no commercial support/SLA is indicated in the notes. TPM should confirm maintainer responsiveness and version-support policy before relying on it for critical maintenance controls.
Support: A Laravel-capable team can own configuration and middleware integration. Operations needs a runbook covering command execution, environment-file permissions, APP_READ_ONLY, config-cache rebuilds, and worker/Octane restarts.
Scaling: Environment-file mutation is node-local unless externalized. Multi-node, autoscaling, and immutable-infrastructure deployments require orchestration to apply maintenance state consistently across instances. Long-running processes may retain stale state until restarted.
Failure modes: Persistence failure now fails without emitting success events, which is an improvement but must be monitored. Other risks include file-permission failures, externally managed APP_READ_ONLY drift, stale configuration/status caches, inconsistent maintenance state across nodes, route misclassification after detection fixes, malformed IPv6 CIDRs, and upstream PHP 8.5 deprecations on Laravel 11 CI. Alert on command failures and verify maintenance-state consistency after each toggle.
Ramp-up: Developer ramp-up is low for Laravel teams. Operational ramp-up is moderate because of environment-file mutation, cache invalidation, multi-node consistency, and route/CIDR regression testing. Include those checks in the production readiness checklist.
How can I help you explore Laravel packages today?