README

An elegant, zero-configuration security package for Laravel Livewire 4 that automatically locks all public component properties from client-side manipulation, unless explicitly marked as unlocked.

✅ Auto-lock properties

✅ Zero configuration

✅ Protects against client-side tampering

✅ Unlock specific properties with #[Unlocked]

✅ Supports Livewire 4 (Single & Multiple File)

Requirements

Livewire ^4.0

Installation

You can install the package via composer:

composer require janecodelife/livewire-secure-properties

Usage

1. Single File Components (SFC)

If you are using Livewire 4's native Single File Components layout, you can safely use the #[Unlocked] attribute inside the anonymous class block:

<?php

use Livewire\Component;
use JaneCodeLife\LivewireSecureProperties\Unlocked;

new class extends Component {
    // ✅ Secured: Locked by default, any client-side update will throw a Security Violation exception
    public string $role = 'admin';

    // 🔓 UNLOCKED: Updatable from client side via wire:model or client-side requests
    #[Unlocked]
    public string $name = 'Jane Joe';
};
?>

<div>
    <input type="text" wire:model.live="name">
    <p>Name: {{ $name }}</p>
    <!-- This would securely block any client-side update attempts -->
    <input type="text" wire:model.live="role">
    <p>Role: {{ $role }}</p>
</div>

2. Multiple File Components (Class-based)

use Livewire\Component;
use JaneCodeLife\LivewireSecureProperties\Unlocked;

class UserProfile extends Component
{
    // ✅ Secured: Locked by default, any client-side update will throw a Security Violation exception
    public string $role = 'admin';

    // 🔓 UNLOCKED: Updatable from client side via wire:model or client-side requests
    #[Unlocked]
    public string $name = 'Jane Joe';

    public function render()
    {
        return view('livewire.user-profile');
    }
}

Video 📺

Configuration

If you need to disable the package globally during specific environments (e.g., local debugging), you can add this environment variable to your .env file:

LIVEWIRE_SECURE_PROPERTIES_ENABLED=false

Security Violations

When a locked property is violated, the package throws a PropertyLockedException with a 403 status code, making it easy to intercept globally or monitor via your error loggers.

💝🤟 Support the Project 🤟💝

Every bit of support fuels the expansion of this ecosystem and helps me write cleaner tools for all of us. Thank you for standing behind independent developers!_ 🙏🤟

💝🤟 A huge thank you to our sponsors! 💝🤟

🔗 My Other Plugins

Check out my other open-source tools to supercharge your Neovim environment:

livewire-secure-properties - Secure livewire app properties by default and void headache.
todo-tracker.nvim - Assign and list app todos in a blink
folders-bookmark.nvim - Bookmark folders and accessing them by keymap in a blink
copy-history.nvim - Access your copy (Yank) history and paste it again with support of edit by 1 click in a blink.
rest-client.nvim - run http request from anywhere in a blink
smart-window-focus.nvim - resize split window on focus to be full size to easy to see and debug.
markdown-toc.nvim - access markdown file headings (Table Of Content)
tiny-textobject.nvim - handle text objects (inner/around) without need for Tree-sitter.

janecodelife / livewire-secure-properties

Package info

Security

Fund package maintenance!

Statistics