README

About Laravel Access

Laravel Access is a package that provides a simple way to manage access control per environments in Laravel applications.

Requirements

• PHP >= 8.3
• Laravel >= 10.0

Services required

• Email Server (any driver)
• Cache (any driver)

Installation

Add the package to your project

composer require handersonsilva/laravel-access

Publish the package in your project

php artisan vendor:publish --provider="SecurityTools\LaravelAccess\Providers\AccessServiceProvider"

Middleware

Add the following code to the app/Http/Kernel.php file on the global middleware

protected $middleware = [
        \SecurityTools\LaravelAccess\Middleware\AccessMiddleware::class,
        ...
];

Laravel 11+ (bootstrap/app.php)

If your app uses the new Laravel bootstrap middleware configuration, register AccessMiddleware in bootstrap/app.php:

->withMiddleware(function (Middleware $middleware): void {
    $middleware->web(append: [
        \SecurityTools\LaravelAccess\Middleware\AccessMiddleware::class,
    ]);
})

Laravel + React (Inertia) stack

If your project uses Laravel with React and Inertia, requests sent with X-Inertia should use a full-page redirect when access is blocked.
Add a middleware like HandleInertiaAccessRedirect and register it before AccessMiddleware.

1) Create the middleware

<?php

namespace App\Http\Middleware;

use Closure;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\URL;
use Inertia\Inertia;
use SecurityTools\LaravelAccess\Services\AccessService;
use Symfony\Component\HttpFoundation\Response;

class HandleInertiaAccessRedirect
{
    public function __construct(private readonly AccessService $accessService)
    {
    }

    /**
     * Ensure Inertia requests trigger a full-page redirect when access is blocked.
     *
     * @param  Closure(Request): Response  $next
     */
    public function handle(Request $request, Closure $next): Response
    {
        if ($request->header('X-Inertia') && $this->accessService->isBlocked($request)) {
            return Inertia::location(URL::route(AccessService::DEFAULT_ROUTE_ACCESS));
        }

        return $next($request);
    }
}

2) Register in bootstrap/app.php

->withMiddleware(function (Middleware $middleware): void {
    $middleware->web(append: [
        \App\Http\Middleware\HandleInertiaAccessRedirect::class,
        \SecurityTools\LaravelAccess\Middleware\AccessMiddleware::class,
    ]);
})

3) Cookie encryption compatibility

This package manages the access cookie _ac_ck directly.
In the host app, exclude this cookie from Laravel cookie encryption:

$middleware->encryptCookies(except: [
    '_ac_ck',
]);

Run the initial configuration

php artisan access:install

Configuration

Add environments in the .env file

# Access  
ACCESS_ENABLE=true # Enable access
ACCESS_SECRET=your_secret_key # Generate any secret key 

Block access to the application per environment

Add the following code to the config/access.php file to block access to the application in the environments you want.

'block_env' => ['local'], # Environments to block access to the application ex: ['local', 'staging', 'production']

Block access to the application per route prefix

'block_prefixes' => ['/admin'], # Prefixes to block access to the application ex: ['/admin', '/private']

Define the default route to redirect the user after validation

'redirect_prefix' => '/admin',# Default route to redirect the user after validation default: '/'

See the complete configuration in the config/access.php file

Auto Login

To enable auto login, add the following code to the .env file

# Access  
ACCESS_AUTO_LOGIN=true # Enable auto login
ACCESS_GUARD=web # Guard to be used for authentication

When auto login is enabled, the user will be automatically authenticated to the application without the need to enter the login and password.

Security Vulnerabilities

If you discover a security vulnerability within Laravel Access, please send an e-mail to Handerson Silva via handersonsylva@gmail.com. All security vulnerabilities will be promptly addressed.

License

The Laravel Access framework is open-sourced software licensed under the MIT license.