Laravel Model::shouldBeStrict(): make silent Eloquent bugs loud

The Vue form says “Profile saved”. The toast is green. The timezone never changed, because timezone was validated but never added to the model’s fillable list, and Eloquent threw it away without a word. Laravel has one line that turns that silence into an error you see the first time you click Save.

What shouldBeStrict is and why people miss it#

Model::shouldBeStrict() landed in Laravel 9.35 (October 2022, PR #44283). It is a shortcut that calls three switches for you:

public static function shouldBeStrict(bool $shouldBeStrict = true)
{
    static::preventLazyLoading($shouldBeStrict);
    static::preventSilentlyDiscardingAttributes($shouldBeStrict);
    static::preventAccessingMissingAttributes($shouldBeStrict);
}

Why most people miss it: the 13.x docs document the first two switches and never mention the one-liner or the third switch. You find shouldBeStrict() by reading the source, or you don’t find it.

The usual way vs the gem#

The usual way is no way at all: you find these bugs in production, from a support ticket. Here is the same code in our Laravel 13.38 lab, before and after one line.

#[Fillable(['user_id', 'title', 'body'])]
class Post extends Model {}

Post::create([..., 'is_featured' => true]);
// saved, is_featured silently dropped

$user = User::select('id', 'name')->first();
$user->email;    // null
$user->is_admn;  // null (typo, no warning)

Post::all()->each(fn ($post) => $post->user->name);
// 1 + 6 queries, the classic N+1

#[Fillable(['user_id', 'title', 'body'])]
class Post extends Model {}

Post::create([..., 'is_featured' => true]);
// MassAssignmentException: Add fillable property [is_featured]
// to allow mass assignment on [App\Models\Post].

$user = User::select('id', 'name')->first();
$user->email;
// MissingAttributeException: The attribute [email] either does not
// exist or was not retrieved for model [App\Models\User].

Post::all()->each(fn ($post) => $post->user->name);
// LazyLoadingViolationException: Attempted to lazy load [user]
// on model [App\Models\Post] but lazy loading is disabled.

The setup is one line, scoped to every environment except production:

use Illuminate\Database\Eloquent\Model;

public function boot(): void
{
    Model::shouldBeStrict(! $this->app->isProduction()); 
}

Your test suite runs with APP_ENV=testing, so strict mode is on in CI too. That is where it earns its keep.

Real-world example: the Inertia profile form#

The bug from the intro, in full. The form request validates timezone, the controller passes the validated data to update(), and the model’s fillable list was written before anyone thought of timezones.

public function update(ProfileUpdateRequest $request): RedirectResponse
{
    $request->user()->update($request->validated()); // name, email, timezone

    return back()->with('success', 'Profile saved');
}

#[Fillable(['name', 'email'])] // timezone missing
class User extends Authenticatable
{
    // ...
}

Without strict mode, the Vue page gets a redirect, a green toast and the old timezone. In the lab, the same update() with an extra key saved name and dropped the rest without a trace.

With strict mode, the request throws MassAssignmentException: Add fillable property [timezone] to allow mass assignment on [App\Models\User]. The update does not run at all, so you see the error page in development instead of half-saved data. The fix is the obvious one: add timezone to #[Fillable].

The appended accessor trap#

The missing-attribute check also catches a quieter Inertia bug. You trim a list query to the columns the table needs, and forget that the model appends an accessor that reads a column you just removed.

#[Appends(['excerpt'])]
class Post extends Model
{
    protected function excerpt(): Attribute
    {
        return Attribute::get(fn () => Str::limit($this->body, 120));
    }
}

return Inertia::render('Posts/Index', [
    'posts' => Post::select('id', 'title')->get(), // no body
]);

By default every card gets an empty excerpt. With strict mode, serializing the prop throws MissingAttributeException for body, and you notice before your users do. In the lab, plain toArray() on a trimmed model without appends did not throw: it only serializes what you selected.

A safe production setup#

Throwing in production is usually not what you want. The other common setup keeps the checks on everywhere and reports violations in production instead of crashing:

use Illuminate\Database\Eloquent\Model;

public function boot(): void
{
    Model::shouldBeStrict();

    if ($this->app->isProduction()) {
        Model::handleLazyLoadingViolationUsing(fn (Model $model, string $relation, Throwable $e) => report($e));
        Model::handleMissingAttributeViolationUsing(fn (Model $model, string $key, Throwable $e) => report($e));
        Model::handleDiscardedAttributeViolationUsing(fn (Model $model, array $keys, Throwable $e) => report($e));
    }
}

The exception as a third argument is new: PR #61504 shipped in Laravel 13.32. On older versions, build it yourself (new LazyLoadingViolationException($model, $relation)), as the docs example does with a plain info() log.

What the handlers do instead of throwing, measured in the lab:

All three exceptions reached the exception handler through report(), so Sentry, Nightwatch or your log channel see them like any other error.

Gotchas#

Lazy loading only throws on lists. Laravel marks models for the check only when a query returns two or more of them. Post::first()->user and a get() that returns one row lazy loaded without complaint in the lab. Strict mode catches N+1, not every lazy load.

New and just-created models skip the missing-attribute check. new User([...])->is_admin and User::create([...])->is_admin both returned null. Re-fetch the same row and the typo throws. That matters in tests, where most models come straight out of a factory.

Unguarded models bypass the discard check. Inside Model::unguarded(fn () => ...), or on a model with #[Unguarded], every key is fillable, so there is nothing to discard. is_featured saved fine in the lab.

isset() does not throw. isset($user->email) on a trimmed model returned false. Handy when you genuinely don’t know if a column was selected.

Automatic eager loading runs first. If you also enabled automatic eager loading, a missing relation on a list is loaded for the whole collection before the lazy-loading check, so strict mode stops warning about it. The other two checks are unaffected.

Try it yourself#

public function boot(): void
{
    Model::shouldBeStrict(! $this->app->isProduction());
}

php artisan test

Every failure that shows up is a bug you already had: a dropped field, a typo or an N+1. Fix them, or note them and add a handler while you clean up.

How useful is this?#

If you are starting a new Laravel app today, add it before the first model. If the app is old, run the test suite with it on and count the red.

Recap#

• Model::shouldBeStrict() turns on preventLazyLoading, preventSilentlyDiscardingAttributes and preventAccessingMissingAttributes.
• Use ! $this->app->isProduction() to keep it in local and CI, or keep it on and register handlers in production.
• Since Laravel 13.32 the handlers receive the exception, so report($e) is all you need.
• It checks lists for N+1 and fetched models for missing attributes; single, new and just-created models skip those.
• Tested on Laravel 13.38 with 10 Pest tests in a scratch app.

FAQ#

Next steps#

• Laravel automatic eager loading, the other half of the N+1 story
• Form requests with Inertia, where validated data meets #[Fillable]
• API resources for Vue, to keep Inertia props to the fields you chose
• Laravel docs: Configuring Eloquent strictness

Sources#

• Laravel 13 docs: Configuring Eloquent strictness
• Laravel 13 docs: Mass assignment exceptions
• Laravel 13 docs: Preventing lazy loading
• laravel/framework PR #44283: preventAccessingMissingAttributes() and shouldBeStrict() (Laravel 9.35)
• laravel/framework PR #44664: handlers for discarded and missing attribute violations
• laravel/framework v13.32.0 release (PR #61504: pass the exception to violation callbacks)
• Source: Illuminate\Database\Eloquent\Model::shouldBeStrict