telescope: Fatal error when deploying to production

composer require laravel/telescope –dev

😉

Hey everyone, Telescope is meant to be used for dev purposes AND production as well, however using it in production needs to be controlled and secured.

If you don’t want to use it in production, just add the package to extra.laravel.dont-discover in your composer.json and only register the ServiceProvider if the environment isn’t production.

if ($this->app->environment('local')) {
    $this->app->register(\Laravel\Telescope\TelescopeServiceProvider::class);
    $this->app->register(\App\Providers\TelescopeServiceProvider::class);
}

@dindong did you put don’t discover in composer.json?

    "extra": {
        "laravel": {
            "dont-discover": [
                "laravel/telescope"
            ]
        }
    },

Then in AppServiceProvider register() do something like

        if ($this->app->environment() === 'local') {
            $this->app->register(\Laravel\Telescope\TelescopeServiceProvider::class);
            $this->app->register(TelescopeServiceProvider::class);
        }

I often compare Telescope to the Debugbar, both are packages that, IMHO, should not be installed on production. If for some reason there is something wrong with the Gate, and you expose Telescope or Debugbar to the outside world, you expose details of your application that should not be public.

So I’d rather see a solution that does not involve installing it as a regular dependency. Maybe this issue could be opened again?

I’m having this same issue where php artisan package:discover after composer install --no-dev results in…

In TelescopeServiceProvider.php line 10:

  Class 'Laravel\Telescope\TelescopeApplicationServiceProvider' not found

I have telescope in don’t discover in composer.json… I can tell you, my problem is that the suggested code in AppServiceProvider…

$this->app->isLocal()

This does not work. I expected this value to change when I switch my .env APP_ENV variable. It does not change correctly.

Ultimately my problem was not running…

php artisan config:clear

After updating my .env file.

Like @matthewhall-ca mentioned this should be handled like Debugbar. Just install Telescope with composer require laravel/telescope --dev and there should nothing to be worried about when deploying to production.

App\Providers\TelescopeServiceProvider::class should not be added to config/app.php.

Like @browner12 mentioned package auto-discovery should handle this?

What about the public/vendor/telescope folder? Shouldn’t be there either I guess.

@mvdnbrk Sure, but to prevent security issues I’d rather not have it installed on production at all. If a bug slips through and a part of Telescope exposes things that it shouldn’t, we’ve got a problem. And sure, the Gate should prevent it, but what if something is bugged or misconfigured.

If I can just not install Telescope on production, I’ve got nothing to worry about.

I required provide in app service provider and added package to dont-auotload as descriped. If I run php artisan package:discover after composer install --no-dev I get the following Error:

In TelescopeServiceProvider.php line 10:

  Class 'Laravel\Telescope\TelescopeApplicationServiceProvider' not found

Am I doing anything wrong?

@dindong \Laravel\Telescope\TelescopeServiceProvider::class is the one that loads all the telescope routes. You need to register that if you are not using auto discover (like me).

What’s the problem with having the public/vendor/telescope file? I don’t understand.

A route to telescope/assets/stylesheets or similar seems more elegant to me. That route can take of serving all the necessary assets. Keeps the public folder clean as well.

We don’t care about Windows, so symlinks are fine here. Guess they won’t work on Windows.

What harm could a dead symlink in public/vendor do? In this case I rather prefer a dead symlink over pushing these (ultimately unused) assets to production.

@fylzero This actually worked for me.

If you load the service provider manually as in https://github.com/laravel/telescope/issues/154#issuecomment-432938123, it should work in production without issues.

that’s the question, though. I’m still confused if this package is intended to be used in Production or not.