Weave Code
Laravel Janitor Laravel Package
signifly/laravel-janitor
Laravel Janitor is a lightweight Laravel package for automatically cleaning up stale Eloquent records. Define which models and records should be pruned, then let scheduled cleanup keep your database tidy without custom commands.
🔑 Easily add login proxy to your Laravel API
Frequently asked questions about Laravel Janitor
- What does signifly/laravel-janitor actually do?
- It implements a backend-for-frontend login proxy for Laravel APIs. Your SPA posts credentials to your Laravel app, which exchanges them with an OAuth2 authorization server such as Laravel Passport and returns the access and refresh tokens as HttpOnly cookies. The main benefit is that tokens never touch JavaScript, which removes the usual XSS token-theft risk in single-page apps. The package itself is small: a service provider, a config file, login/refresh/logout controllers, and cookie-aware middleware.
- Is Laravel Janitor a replacement for Laravel Sanctum?
- No, and using both is redundant. Sanctum already provides cookie-based SPA sessions for first-party apps, so if you are on Sanctum you do not need a login proxy at all. Janitor fits the case where you have a separate-origin SPA, a Laravel API, and a centralized Passport-style token issuer you want to keep server-side. If your topology does not match that, the package adds complexity without benefit.
- Which Laravel and PHP versions does Laravel Janitor support?
- The last release was 2023-08-03, so expect constraints that stop well before current Laravel and PHP majors. Check the composer.json constraints against your actual version matrix before estimating any work, because a failed resolve turns a quick install into a fork-and-patch exercise. Assume a Laravel 8/9/10-era codebase until you have verified otherwise.
- How do I install and configure Laravel Janitor?
- The flow is composer require, publish the config, mount the routes, and point the package at your token endpoint. The code work is minor; the effort is in the identity contract: token endpoint URL, grant type, client ID and secret, scopes, cookie domain and SameSite policy. You also need the SPA's fetch calls configured with credentials include and the correct CSRF header handling. Budget two to five engineer-days for an end-to-end spike, most of it spent on cross-origin cookie and CORS debugging.
- Does Laravel Janitor work with the Laravel Passport password grant?
- That is the typical configuration it was built around, since a login proxy forwards a username and password to the authorization server. Be aware that Passport and the wider OAuth ecosystem have been steering away from the password grant toward authorization code with PKCE. If your identity provider only supports authorization code with PKCE or is a third-party IdP, this is the wrong grant and the package does not fit.
- Is Laravel Janitor safe to use in production if it is archived?
- It is an accepted-liability decision, not a neutral one. The package has had no maintainer and no releases since August 2023, and authentication code without upstream patching will not receive security fixes. The mitigating factor is that the surface area is small: roughly 200 to 400 lines you can fully review and own. Treat it as source code to adopt, not a dependency to consume, and do not ship it unmodified on a security boundary.
- How are cookies scoped in Laravel Janitor, and does it survive a cross-site SPA?
- Cookie behavior comes from the package config plus your Laravel session and CORS settings: domain, Secure, HttpOnly, and SameSite. This is the part that breaks most often in multi-subdomain or cross-site deployments, because SameSite=None requires Secure and correct CORS credentials handling on both ends. Verify the exact cookie attributes in a staging environment that mirrors production origins before you commit.
- Does Laravel Janitor handle refresh token rotation and revocation on logout?
- Expect only the happy path until you read the source. Refresh endpoint and logout controller exist, but whether the package implements refresh-token rotation, revocation of the underlying tokens on logout, and propagation of token expiry to the SPA is not guaranteed. With 60 stars and a single maintainer, subtle cookie, CSRF, or revocation defects are unlikely to have been found and fixed. Add contract tests around each of these behaviors if you adopt it.
- Does Laravel Janitor include login throttling or brute-force protection?
- Do not assume it does. Login throttling is typically left to the application, for example Laravel's rate limiter middleware on the proxy login route. Plan to add throttling, failed-attempt logging, and lockout behavior yourself, and test them against the proxy route rather than the token endpoint directly.
- Should I fork Laravel Janitor or reimplement the login proxy myself?
- Fork and own it if the composer constraints resolve against your stack. Import it into a private package repository such as Private Packagist or Satis, or inline it under app/Support, pin the fork, and treat it as first-party code with dependency automation and tests. Because the package is small, reimplementing it from scratch is also viable and sometimes faster than patching framework drift. Either way, decide the exit cost up front in case your identity provider changes in the next 18 months.
Weaver
How can I help you explore Laravel packages today?