jeffersongoncalves / laravel-session-management

1.0.0 2026-10-24 18:22 UTC

Requires

• php: ^8.2
• illuminate/console: ^11.0|^12.0|^13.0
• illuminate/contracts: ^11.0|^12.0|^13.0
• illuminate/database: ^11.0|^12.0|^13.0
• illuminate/support: ^11.0|^12.0|^13.0
• spatie/laravel-package-tools: ^1.16

Requires (Dev)

• larastan/larastan: ^3.0
• laravel/pint: ^1.24
• orchestra/testbench: ^9.0|^10.0|^11.0
• pestphp/pest: ^3.0|^4.0
• pestphp/pest-plugin-laravel: ^3.0|^4.0

MIT

• Jefferson Gonçalves

• session
• laravel
• sessions
• session-management
• database-sessions

Published on Packagist.org on 2026-10-24 18:42 UTC

README

Laravel Session Management

Read and manage Laravel's database session table (sessions) through an Eloquent model and a small service layer: list who is logged in, decode session payloads safely, revoke sessions and prune expired ones. It is the framework-agnostic core of jeffersongoncalves/filament-session-management.

Features

• Session model on top of the sessions table (follows session.table / session.connection)
• user() relation plus active(), expired(), guests(), authenticated() and forUser() scopes
• decodePayload() that handles plain, encrypted (session.encrypt) and JSON (session.serialization) payloads
• Payloads are unserialized with allowed_classes => false: stored objects are never instantiated
• CSRF token and password_hash_* keys masked by default
• SessionManagement::revoke(), revokeUser() and prune(), plus a session-management:prune command

Installation

composer require jeffersongoncalves/laravel-session-management

Optionally publish the config file:

php artisan vendor:publish --tag="session-management-config"

The package reads the table written by Laravel's database session driver. Set SESSION_DRIVER=database and create the table (php artisan make:session-table on older apps; new Laravel apps ship it in the default migration).

Usage

The model

use JeffersonGoncalves\SessionManagement\Models\Session;

$sessions = Session::query()
    ->active()
    ->forUser($user)
    ->orderByDesc('last_activity')
    ->get();

$session->user;            // owner, or null for guests
$session->lastActivityAt;  // Carbon
$session->isExpired;       // older than session.lifetime
$session->isCurrent;       // the session of the current request
$session->decodePayload(); // ['_token' => '********', 'url' => [...], ...]
$session->decodePayload(masked: false);

The service

use JeffersonGoncalves\SessionManagement\Facades\SessionManagement;

SessionManagement::revoke($id, $otherId);                 // delete sessions by id
SessionManagement::revokeUser($user, session()->getId()); // log a user out everywhere else
SessionManagement::prune();                               // delete expired sessions

Revoking deletes the session row, so its owner is logged out on the next request. A "remember me" cookie logs them back in: cycle the user's remember_token too when that must not happen (or use Auth::logoutOtherDevices() for the current user).

Pruning

Laravel's session garbage collector only runs on a lottery. To prune on a schedule:

use Illuminate\Support\Facades\Schedule;

Schedule::command('session-management:prune')->daily();

Configuration

return [
    'table' => null,      // null => session.table
    'connection' => null, // null => session.connection
    'user_model' => null, // null => auth.providers.users.model
    'hidden_payload_keys' => [
        '_token',
        'password_hash_*',
    ],
];

Testing

composer test

Changelog

Please see CHANGELOG for more information on what has changed recently.

Security Vulnerabilities

Please review our security policy on how to report security vulnerabilities.

Credits

• Jefferson Gonçalves
• All Contributors

License

The MIT License (MIT). Please see License File for more information.