An Access Control List (ACL) solution for Laravel applications, providing roles and permissions management with security and usability in mind.
Defender is an Access Control List (ACL) solution for Laravel applications that manages roles and permissions. It provides a secure way to control user access to different parts of an application, integrating seamlessly with Laravel's authentication system. The package includes features like middleware for route protection, Blade directives for view-level control, and support for temporary permissions.
Laravel developers building applications that require fine-grained user access control, such as admin panels, multi-tenant systems, or any app with role-based permissions.
Developers choose Defender for its deep integration with Laravel, comprehensive feature set including temporary permissions and JavaScript helpers, and its focus on security without sacrificing usability. It's a dedicated ACL package that simplifies complex permission structures.
Roles & Permissions for Laravel
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Defender seamlessly integrates with Laravel's ecosystem, offering built-in middleware like 'needsPermission' for route protection, Blade directives such as @shield for view-level control, and artisan commands for role and permission management, as detailed in the Usage section.
It uniquely supports time-based access control with automatic expiration, allowing permissions to be granted or revoked for specific durations using Carbon, ideal for features like trial access, as explained in the Temporary Permissions section.
Defender provides a JavaScript helper that injects user permissions and roles into the frontend via Defender::javascript()->render(), enabling client-side access control without additional API calls, highlighted in the JavaScript Helper section.
It allows extending and using custom Role and Permission models, making it adaptable to different database drivers like MongoDB, as demonstrated in the Using custom Role and Permission models section with examples for non-SQL databases.
The README explicitly states Defender is not compatible with multi-auth, limiting its use in applications with multiple authentication guards or complex user types, a significant drawback for modern Laravel setups.
Setup requires publishing configuration files and migrations, registering service providers for Laravel <5.5, and manually adding middleware to the Kernel, which adds complexity compared to more modern auto-discovered packages.
The project is actively looking for maintainers and contributors, as noted in the Contribution welcome section, which could lead to slower updates, fewer features, or compatibility issues with future Laravel versions.