Libraries tagged by Session Security

Device management, logout other devices and new-device alerts for Laravel — without giving up your cache-based session driver.

Go to Download

Laravel-aware security rules for php-security-scanner. Detects Laravel SQL injection (DB::raw, whereRaw), mass assignment, debug/dd leaks, unsafe validators, CSRF bypass, insecure cookies, env exposure, Blade raw echo, open redirect, Http SSRF, Storage/File path traversal, file-upload validation gaps, Auth/Crypt/Artisan/Process/Config injection, view-name injection, session fixation, and Mail header injection.

Go to Download

Authentication security for Laravel — two-factor authentication (email/TOTP), password complexity and breach checking, account lockout, and session management.

Go to Download

A PHP library acting as a wrapper for PHP's default session handling functions which stores data in a MySQL database, providing both better performance and better security and protection against session fixation and session hijacking.

Go to Download

Device Bound Session Credentials (DBSC) for Symfony - protect sessions from cookie theft with hardware-bound keys.

Go to Download

Opaque, rotating refresh tokens and device sessions for Laravel — SHA-256 at rest, atomic anti-double-spend rotation, family revocation on reuse. Zero third-party runtime deps.

Go to Download

Passkey / WebAuthn adapter for the Milpa PHP framework: the lbuchs/webauthn implementation of milpa/auth's WebAuthnVerifier, plus in-memory challenge and credential stores. Ceremony types and contracts live in milpa/auth. A verified assertion mints a session — it is never a per-request transport. Zero framework, zero ORM.

Go to Download

Signed access tokens and opaque refresh tokens with SQL token store and token authentication (subject + tenant), session handling, password hashing, and role-based access control for PHP DDD applications — framework-free, no JWT, no third-party runtime dependencies beyond PHP built-ins and the Jardis contracts and dbquery packages

Go to Download

A high-performance, decoupled audit logging and real-time threat detection package for Laravel. Features action log diffs, session activity tracking, custom authorization callbacks, and queued alerts.

Go to Download

Modern session management for PHP

Go to Download

Session authentication component for OXID eShop

Go to Download

Device-bound login sessions for Laravel: per-device remember-me tokens, a "where am I signed in" device list, and revoke/rename — privacy-respecting and Fortify-agnostic.

Go to Download

Enterprise USSD framework for Laravel. Multi-provider support (Safaricom, Airtel, MTN), session management, menu builders, form collection, pagination, security, analytics, and i18n for African mobile networks.

Go to Download

Enterprise-grade login security for Filament: brute-force lockouts with escalation, self-service unlock, and active session management.

Go to Download

Laravel Session theft protection via client fingerprinting — auto-invalidates sessions used from unrecognized devices.

Go to Download