How to install Defender in Laravel 9?

Install via Composer with 'composer require artesaos/defender', then publish the configuration and migrations using 'php artisan vendor:publish', and run 'php artisan migrate'. For Laravel >=5.5, auto-discovery handles provider registration, but older versions require manual setup in config/app.php.

Defender vs Spatie Laravel Permission which is better?

Defender offers unique features like temporary permissions and JavaScript helpers, while Spatie's package is more widely adopted with a larger community and regular updates. Choose Defender if you need time-based permissions; otherwise, Spatie might be more reliable for standard role-based access control.

Can Defender handle temporary permissions for trial users?

Yes, Defender supports temporary permissions with expiration dates. You can attach permissions using the 'expires' option with Carbon, allowing automatic revocation after a set period, perfect for implementing trial features or temporary admin access.

How to secure API routes with Defender middleware?

Use the 'needsPermission' or 'needsRole' middleware in your route definitions or controllers. For example, in routes/api.php, add Route::get('admin', function() {})->middleware(['auth', 'needsPermission:admin.access']) to protect based on permissions.

Does Defender work with Laravel Sanctum or multiple guards?

No, Defender is explicitly not compatible with multi-auth setups, including multiple guards like those used with Laravel Sanctum or Passport. It's designed for single authentication systems, so alternatives are needed for complex auth scenarios.

How to check permissions in Blade views with Defender?

Use Blade directives like @shield('permission.name') to conditionally show content based on user permissions, or @is('role') for role-based checks. These directives are integrated directly into Defender's ACL system, as shown in the Using in Views section.

Defender — Laravel ACL with Roles & Permissions

What is Defender?

Defender is an Access Control List (ACL) solution for Laravel applications that manages roles and permissions. It provides a secure way to control user access to different parts of an application, integrating seamlessly with Laravel's authentication system. The package includes features like middleware for route protection, Blade directives for view-level control, and support for temporary permissions.

Target Audience

Laravel developers building applications that require fine-grained user access control, such as admin panels, multi-tenant systems, or any app with role-based permissions.

Value Proposition

Developers choose Defender for its deep integration with Laravel, comprehensive feature set including temporary permissions and JavaScript helpers, and its focus on security without sacrificing usability. It's a dedicated ACL package that simplifies complex permission structures.

Roles & Permissions for Laravel

Use Cases

Best For

Adding role-based access control to Laravel admin panels
Securing API endpoints with permission-based middleware
Implementing temporary user permissions for trial features
Managing multi-level user roles in SaaS applications
Conditionally showing UI elements based on user permissions
Extending Laravel's built-in authentication with ACL capabilities

Not Ideal For

Applications using Laravel's multi-auth or multiple authentication guards
Projects needing a pre-built admin UI for managing roles and permissions out of the box
Systems requiring complex hierarchical roles or conditional permission inheritance beyond flat structures
Teams wanting a zero-configuration drop-in package with full auto-discovery and minimal setup

Pros & Cons

Pros

Deep Laravel Integration

Defender seamlessly integrates with Laravel's ecosystem, offering built-in middleware like 'needsPermission' for route protection, Blade directives such as @shield for view-level control, and artisan commands for role and permission management, as detailed in the Usage section.

Temporary Permissions

It uniquely supports time-based access control with automatic expiration, allowing permissions to be granted or revoked for specific durations using Carbon, ideal for features like trial access, as explained in the Temporary Permissions section.

Frontend JavaScript Helper

Defender provides a JavaScript helper that injects user permissions and roles into the frontend via Defender::javascript()->render(), enabling client-side access control without additional API calls, highlighted in the JavaScript Helper section.

Custom Model Flexibility

It allows extending and using custom Role and Permission models, making it adaptable to different database drivers like MongoDB, as demonstrated in the Using custom Role and Permission models section with examples for non-SQL databases.

Cons

No Multi-Auth Support

The README explicitly states Defender is not compatible with multi-auth, limiting its use in applications with multiple authentication guards or complex user types, a significant drawback for modern Laravel setups.

Manual Configuration Overhead

Setup requires publishing configuration files and migrations, registering service providers for Laravel <5.5, and manually adding middleware to the Kernel, which adds complexity compared to more modern auto-discovered packages.

Potential Maintenance Risks

The project is actively looking for maintainers and contributors, as noted in the Contribution welcome section, which could lead to slower updates, fewer features, or compatibility issues with future Laravel versions.

Frequently Asked Questions

What is Defender?

Target Audience

Laravel developers building applications that require fine-grained user access control, such as admin panels, multi-tenant systems, or any app with role-based permissions.

Value Proposition

Use Cases

Best For

Adding role-based access control to Laravel admin panels
Securing API endpoints with permission-based middleware
Implementing temporary user permissions for trial features
Managing multi-level user roles in SaaS applications
Conditionally showing UI elements based on user permissions
Extending Laravel's built-in authentication with ACL capabilities

Not Ideal For

Applications using Laravel's multi-auth or multiple authentication guards
Projects needing a pre-built admin UI for managing roles and permissions out of the box
Systems requiring complex hierarchical roles or conditional permission inheritance beyond flat structures
Teams wanting a zero-configuration drop-in package with full auto-discovery and minimal setup

Pros & Cons

Pros

Deep Laravel Integration

Temporary Permissions

Frontend JavaScript Helper

Custom Model Flexibility

Cons

No Multi-Auth Support

Manual Configuration Overhead

Potential Maintenance Risks

Frequently Asked Questions

Defender

What is Defender?

Overview

Use Cases

Best For

Not Ideal For

Pros & Cons

Pros

Cons

Frequently Asked Questions

Related Projects

Found a gem we're missing?

Defender

What is Defender?

Overview

Use Cases

Best For

Not Ideal For

Pros & Cons

Pros

Cons

Frequently Asked Questions

Related Projects

Found a gem we're missing?