PHP download

Download the PHP package darvis/livewire-injection-stopper without Composer

On this page you can find all versions of the php package darvis/livewire-injection-stopper. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.

Table of contents
Download darvis/livewire-injection-stopper
More information about darvis/livewire-injection-stopper
Files in darvis/livewire-injection-stopper

Vendor darvis
Package livewire-injection-stopper
Short Description Blocks spam bots and Livewire payload injection in Laravel apps, keeps the resulting Livewire exceptions out of Sentry, and audits Livewire components for unlocked public properties.
License MIT
Homepage https://arviddejong.github.io/livewire-injection-stopper/

Keywords security middleware laravel spam-protection livewire security-audit injection-protection laravel-boost

FAQ

After the download, you have to make one include require_once('vendor/autoload.php');. After that you have to import the classes with use statements.

Example:

If you use only one package a project is not needed. But if you use more then one package, without a project it is not possible to import the classes with use statements.

In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.

Some PHP packages are not free to download and because of that hosted in private repositories. In this case some credentials are needed to access such packages. Please use the auth.json textarea to insert credentials, if a package is coming from a private repository. You can look here for more information.

Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
To use Composer is sometimes complicated. Especially for beginners.
Composer needs much resources. Sometimes they are not available on a simple webspace.
If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.

Please rate this library. Is it a good library?

Example code of darvis/livewire-injection-stopper

Informations about the package livewire-injection-stopper

darvis/livewire-injection-stopper

A Laravel package for applications that use Livewire. Its middleware rejects requests from listed User-Agents and IP addresses, and Livewire update requests that send an array to a property that should hold a single value. It also keeps two bot-driven Livewire exceptions out of your error tracker, and its audit command lists public Livewire properties that probably need #[Locked].

Features

Rejects a request whose User-Agent contains a listed pattern (python, curl/, wget, go-http-client, axios, named SEO and AI crawlers and more), with an allow list for uptime monitors. The default list holds no search engine.
Rejects the exact IP addresses you list, and skips every check on the paths you whitelist, such as webhooks
Inspects Livewire update requests and rejects an array sent to a property that looks scalar; by default that is every top-level property
Answers CannotUpdateLockedPropertyException and the TypeError from a Livewire array assignment with the block response, and keeps them out of Laravel's exception reporting
php artisan livewire-injection-stopper:audit lists public properties that probably need #[Locked], with exit code 1 for CI
A RequestBlocked event and a log line for every blocked request
A Laravel Boost guideline and skill

It is not a firewall: a bot that sends a browser User-Agent passes, and scalar values are never inspected. See what it does not stop.

Requirements

PHP 8.2+, Laravel 11, 12 or 13, and Livewire 3 or 4.

Installation

Nothing else is needed. The middleware joins the web group, the exception handling registers itself, and the audit command is available. To change a default, publish the config:

One default to know before you install: every array sent to a top-level Livewire property is rejected. A multi-select bound with wire:model="tags" needs a nested key such as form.tags, or block_all_array_injections set to false. See Payload injection.

Quick start

Run the audit:

Lock the property it names:

A request that tries to change isAdmin now gets 403 Access Denied, a log line that starts with [LivewireInjectionStopper] and a RequestBlocked event, and the exception Livewire throws is not reported. The Quick start page has the complete example, including a listener that counts blocked requests.

Documentation

Full documentation at arviddejong.github.io/livewire-injection-stopper:

Installation: the steps, and how to check that it works
Quick start: audit, lock a property and count blocked requests
How it works: the four checks in order, and what the package does not stop
Bot blocking: User-Agents, IP addresses, whitelisted paths, the response, the log line and the event
Payload injection: the payload rules and the two silenced exceptions
Security audit: what the audit scans, its output and its limits
Configuration: every key with its default
Testing: a complete feature test for your own app
Troubleshooting: a legitimate request is blocked, or nothing is
FAQ: short answers

Laravel Boost

The package ships a guideline and a skill for Laravel Boost. Run php artisan boost:install, or php artisan boost:update --discover in a project that already uses Boost.

Testing

Changelog

See CHANGELOG.md.

Support the package

If darvis/livewire-injection-stopper saves you time, buy me a beer 🍺: sponsor me on GitHub.

Contributing

See CONTRIBUTING.md.

Security

Found a way around the bot blocking or the payload inspection? Please report it privately; see SECURITY.md.

License

MIT, see ARVID.NL.

All versions of livewire-injection-stopper with dependencies

PHP Build Version

Package Version

Version v1.3.1 Release 21. Sep 2026
create-project require 0 people chose require and
0 people chose create-project.

Download

Download latest version of livewire-injection-stopper from vendor darvis

Requires php Version ^8.2
laravel/framework Version ^11.0|^12.0|^13.0
livewire/livewire Version ^3.0|^4.0

Composer command for our command line client (download client) This client runs in each environment. You don't need a specific PHP version etc. The first 20 API calls are free. Standard composer command

The package darvis/livewire-injection-stopper contains the following files

Loading the files please wait ...