- How do I install and configure usmonaliyev/laravel-redis-auth in Laravel?
- Install it with composer require usmonaliyev/laravel-redis-auth, then register the package's Redis user provider in config/auth.php and point your guards at it. Because no Laravel version matrix is documented, spike it in a sandbox against your exact Laravel, PHP and Redis versions before wiring it into a real app. Password hashing stays in your application, so keep the standard hashed cast on your user model.
- Which Laravel and PHP versions does laravel-redis-auth support?
- The repository does not publish a Laravel or PHP support matrix and shows no CI configuration, and the last release was September 2024, so Laravel 11 and 12 compatibility should be treated as unverified. Check the composer.json constraints on GitHub and run your own test suite against your target versions. If you adopt it, pin the commit and be prepared to fork.
- Does laravel-redis-auth work with Sanctum, Passport, Fortify, Breeze or Jetstream?
- It plugs in at the user provider layer, so token guards like Sanctum and Passport can in principle keep working as long as the provider resolves users from the right credentials. Fortify, Breeze and Jetstream add flows such as password reset, email verification and 2FA that need explicit verification against a Redis-backed store. Test each flow end to end rather than assuming parity with the Eloquent provider.
- Is it safe to use Redis as the source of truth for user authentication in production?
- Only if you treat Redis as tier-0 infrastructure: enable AOF or RDB persistence, replication, backups and a noeviction maxmemory policy. A Redis instance deployed as a cache with allkeys-lru can silently evict user records, which means locked-out accounts and lost credential data. Run restore drills before decommissioning any SQL auth path.
- What are the main risks of a Redis-backed auth driver?
- The key risks are durability and silent data loss under eviction, compatibility drift with Laravel 11 and 12 auth scaffolding, concurrency correctness for token issuance and rotation, and a single maintainer. The package has roughly 7 stars, zero dependents and no evident security review, so your team effectively owns and audits the code. Relational RBAC, reporting and GDPR erasure workflows break when identity moves out of SQL.
- Does it implement Laravel's UserProvider contract cleanly?
- Architecturally it fits at the provider layer, since Laravel's auth stack is contract-driven and a Redis implementation of Illuminate\Contracts\Auth\UserProvider can slot in without rewriting guards. Verify in the source whether it implements the contract cleanly or forks core auth behavior, and check how users are serialized (PHP serialize vs JSON) and how key or schema migrations are handled. That review matters because you are putting a third-party class on the security-critical path.
- Does laravel-redis-auth support password resets, email verification and two-factor authentication?
- The package description covers authentication lookups only, so password reset, email verification, 2FA and account lockout are not confirmed features. Those flows typically rely on database tokens and notifications, which would need to be re-plumbed or kept in SQL. Test each flow explicitly before shipping.
- How do I migrate from Laravel's Eloquent user provider to Redis auth safely?
- Do not cut over directly. Dual-write users to Redis and SQL with SQL authoritative, shadow-read from Redis and diff against SQL to validate parity, then canary a small percentage of logins behind a feature flag before full cutover. Keep a tested rollback to the Eloquent provider and do not decommission SQL until a backup restore drill has succeeded.
- What Redis configuration and persistence settings do I need before trusting it with auth?
- Harden Redis before it becomes the source of truth: enable AOF or RDB persistence, replication and backups, and use noeviction rather than an LRU policy. Confirm key namespacing and cluster-mode behavior if you shard, and verify both predis and phpredis clients. Treat HA and backup/restore drills as a prerequisite, not a follow-up.
- Is laravel-redis-auth actively maintained, and what are the alternatives?
- Maturity signals are weak: about 7 stars, zero dependents, a single maintainer and a last release in September 2024. If your motivation is faster auth, standard Laravel with Sanctum plus Redis for sessions and cache already captures most of the gain while keeping SQL as the source of truth. Consider this package only for high-throughput, low-relational auth and be ready to vendor a fork internally.