Skip to content
PHP & Laravel Interview Reference

Laravel framework foundations

Status: Complete. Last reviewed 2026-08-27.

This page is a boundary map for the Laravel core. Detailed mechanisms belong in the linked topic pages; the value here is knowing which framework facility owns which decision and where production guarantees actually live.

Application boundary map

Section titled “Application boundary map”

A route selects an endpoint. Middleware wraps requests for cross-cutting protocol concerns. Route model binding resolves URL identity into a model but does not authorize it. A Form Request performs request authorization and input validation before controller invocation, yet validation proves neither a domain invariant nor concurrent validity. A controller adapts HTTP to an application operation and turns its result into a response.

The service container constructs object graphs and applies bindings. Providers register those bindings and then boot integrations after all providers have registered. A facade is a proxy to a container-resolved service, not a static implementation. These mechanisms improve composition but do not decide application architecture. Constructor injection makes dependencies explicit; facades are useful at Laravel boundaries; runtime service location should remain deliberate.

Eloquent maps rows to stateful model snapshots. Casts and accessors change representation, mass-assignment rules filter particular array-assignment paths, and model events observe particular Eloquent operations. None replaces authorization, database constraints, transaction design, or concurrency control. Relationship methods build queries; relationship properties return loaded results and can trigger lazy queries. API Resources shape output and can conditionally include loaded relationships, but the query must eager-load what the resource needs.

Policies and gates decide whether an actor may perform an ability. Authentication establishes identity through a guard and provider; Sanctum supports first-party SPA sessions and simple personal tokens; Passport is an OAuth2 authorization server when delegated clients and grants are genuine requirements. Token abilities narrow credential purpose and do not replace policies or tenant scoping.

Events publish facts to listeners. Ordinary listeners are synchronous unless queued. Jobs explicitly request deferred execution and can be retried or redelivered. Notifications express recipient-oriented delivery across channels. Use a direct call for required ordered workflow; use indirection when it buys independent ownership, latency isolation, delivery semantics, or fan-out. Database commit and broker publication are separate boundaries, so after-commit dispatch or an outbox may be necessary.

Cache stores disposable derived state. Sessions carry browser continuity and deserve stronger availability treatment. Redis may back several Laravel subsystems but creates a shared failure domain. Filesystem disks abstract common operations over storage adapters without erasing local-filesystem versus object-store semantics. Locks are expiring leases; final correctness still belongs to idempotency, conditional writes, or durable uniqueness.

Configuration, errors, and operations

Section titled “Configuration, errors, and operations”

Environment input should be consumed by configuration files, and application code should read resolved configuration. Framework caches optimize configuration, routes, events, and views independently. Exception reporting records diagnostic evidence; rendering produces a safe protocol response. Structured logs need stable context, redaction, useful severity, and correlation across HTTP and queued work.

Artisan commands are automation boundaries with validated input and honest exit codes. The scheduler is a due-task evaluator driven by an external cron or worker; overlap and one-server controls use shared cache locks and do not guarantee exactly once. Long commands need bounded work, checkpoints, cancellation, observable outcomes, and safe reruns.

A deployment changes code, cached artifacts, schema, assets, web runtimes, and long-lived workers. Queue and Octane processes retain a booted application, so they need graceful restart and protection from cross-operation mutable state. Old and new releases coexist during rolling deployment, requiring compatible migrations and queue payloads.

Choosing where logic lives

Section titled “Choosing where logic lives”

“Thin controllers” is useful only when it exposes a better-named boundary. A small controller may validate through a Form Request, authorize through a policy, call one application operation, and return a Resource. Extract logic when it owns a transaction, invariant, reusable policy, external integration, or independently meaningful test boundary—not to satisfy a naming ritual such as putting every method in SomethingService.

Transaction ownership belongs at the operation that must be atomic, often an application action rather than a controller, model observer, or repository method. Domain constraints should have a durable database representation when concurrent processes can violate them. Side effects that cannot participate in the transaction need after-commit dispatch, idempotency, and possibly an outbox/reconciliation loop.

Choose Blade for straightforward server rendering, Livewire for server-driven interactive components where its request/state lifecycle is acceptable, Inertia for Laravel routing with client-framework pages, and a separate API/client when independent deployment or a genuine platform boundary warrants it. No choice removes authorization, validation, caching, or operational design.

Topic map

Section titled “Topic map”

Interview practice

Section titled “Interview practice”

Primary sources

Section titled “Primary sources”