Download the PHP package alexkramse/laravel-hide-forbidden without Composer
On this page you can find all versions of the php package alexkramse/laravel-hide-forbidden. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.
Download alexkramse/laravel-hide-forbidden
More information about alexkramse/laravel-hide-forbidden
Files in alexkramse/laravel-hide-forbidden
Package laravel-hide-forbidden
Short Description Hide all or selected Laravel 403 Forbidden responses behind 404 Not Found responses.
License MIT
FAQ
Example:
In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
- Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
- To use Composer is sometimes complicated. Especially for beginners.
- Composer needs much resources. Sometimes they are not available on a simple webspace.
- If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
- Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Informations about the package laravel-hide-forbidden
Laravel Hide Forbidden
Don’t reveal what should stay hidden. 404 is better than 403 when the existence of a resource should remain private.
Laravel Hide Forbidden improves your application’s security posture by converting selected 403 Forbidden responses into 404 Not Found. This helps prevent exposure of sensitive endpoints such as admin panels, tenant resources, private models, or internal APIs.
The idea for this package comes from a security insight shared by Nuno Maduro: “404 is better than 403” — emphasizing that security should not leak the existence of protected resources. Thanks to Nuno.
By default, the package is enabled only in production and works via middleware, giving you full control over which routes adopt this behavior without affecting Laravel’s global exception handling.
Requirements
- PHP 8.1+
- Laravel 10 | 11 | 12 | 13
Installation
Install the package:
Laravel discovers the service provider automatically through Composer package discovery.
Publish the config:
Usage
Route-Level Usage
The safest way to use the package is to attach the hide-forbidden middleware only to routes where you want forbidden responses hidden:
With the default config, this route-level middleware mode is the only place conversion happens:
Global Usage
To hide every matching 403 response in production, switch to all mode:
Use except_routes and except_paths to keep auth, public API, or other routes unchanged.
Named Route Matching
Use routes mode when you only want to hide forbidden responses for specific named route groups:
Route patterns use Laravel's routeIs() matching.
Path Matching
Use paths mode when routes are not named or when URL patterns are clearer:
Path patterns use Laravel request path matching.
Excluding Auth Routes
Authentication routes are excluded by default so login, logout, registration, password reset, email verification, password confirmation, and Sanctum's SPA CSRF cookie endpoint keep their normal behavior:
Add your own routes when they should keep returning a real 403
JSON Responses
JSON requests receive the configured payload with a 404 status:
Example response:
Guard Matching
By default, all guards are eligible. To convert only when a specific guard is authenticated:
When guards is empty, no guard check is required.
Logging
To log every hidden forbidden response:
The log entry includes the route name and path, while the client still receives a 404.
What Gets Converted
By default, the package converts:
Illuminate\Auth\Access\AuthorizationExceptionSymfony\Component\HttpKernel\Exception\AccessDeniedHttpException- Any Symfony HTTP exception with status code
403 - Route middleware responses that already rendered as
403
Non-forbidden server errors are not converted.
