Download the PHP package smony/filament-user-sessions without Composer
On this page you can find all versions of the php package smony/filament-user-sessions. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.
FAQ
Example:
In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
- Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
- To use Composer is sometimes complicated. Especially for beginners.
- Composer needs much resources. Sometimes they are not available on a simple webspace.
- If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
- Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Informations about the package filament-user-sessions
Filament User Sessions
See every active session across your app — who's logged in, from where, on what device — and force-logout anyone with one click, right from your Filament admin panel.
Requirements
- Laravel with
SESSION_DRIVER=database(this plugin reads thesessionstable, so file/cookie/array drivers won't work) - Filament v4 or v5
Still on Filament v3? Use
composer require smony/filament-user-sessions:^1.0instead.
Installation
Make sure you have the sessions table migration (Laravel ships one, or generate it), then migrate — this also creates the package's own session_known_devices table, used to flag new-device logins:
Register the plugin in your Panel Provider:
What you get
- A Sessions page listing every active session: user, IP address, parsed device/browser, last activity
- An "Online now" stat widget
- A Revoke action to instantly force-logout any session (except your own current one)
- Bulk revoke for cleaning up stale sessions
- A "New device" flag on sessions from a browser/platform combination not seen for that user before — useful for spotting a compromised account at a glance
Configuration
Optionally publish the config to change the sessions table name, the "online" threshold, or the new-device detection window:
New device detection
On every login, the plugin records a fingerprint (browser + platform, e.g. "Chrome on Windows") for that user in the session_known_devices table, which — unlike sessions — persists across logout. A session is flagged New in the table if its fingerprint was first seen for that user within the last 24 hours (configurable via new_device_window_hours).
This is a coarse signal, not a strict security boundary: it doesn't fingerprint by IP (to avoid false positives from VPNs/mobile networks), so two different physical devices reporting the same browser/OS combination look identical.
Notifying your security team
The first time (and only the first time) a device is seen for a user, whoever you configure as recipients gets notified via Smony\FilamentUserSessions\Notifications\NewDeviceLogin. The package has no way to know who your admins/security team are, so nothing is sent until you implement Smony\FilamentUserSessions\Contracts\ResolvesNewDeviceRecipients and point new_device_notification_recipients at it:
Configure delivery via new_device_notification_channels (default ['mail']; add database for a Filament/Laravel database notification — requires php artisan notifications:table and Notifiable recipient models), or disable entirely with notify_on_new_device => false.
Authorization
By default, any user who can access your panel can view all sessions and revoke any of them (except their own current one). If that's too permissive — e.g. you don't want a support-role admin to be able to kick out a superadmin — register your own policy for the Session model in your AuthServiceProvider:
Your policy can implement viewAny, view, delete, and deleteAny — the same names Laravel and Filament use for standard CRUD abilities:
Registering it in your own AuthServiceProvider overrides the package's permissive default, since app providers boot after package providers.
License
MIT
