Download the PHP package elhebert/laravel-sri without Composer

On this page you can find all versions of the php package elhebert/laravel-sri. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.

FAQ

After the download, you have to make one include require_once('vendor/autoload.php');. After that you have to import the classes with use statements.

Example:
If you use only one package a project is not needed. But if you use more then one package, without a project it is not possible to import the classes with use statements.

In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
Some PHP packages are not free to download and because of that hosted in private repositories. In this case some credentials are needed to access such packages. Please use the auth.json textarea to insert credentials, if a package is coming from a private repository. You can look here for more information.

  • Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
  • To use Composer is sometimes complicated. Especially for beginners.
  • Composer needs much resources. Sometimes they are not available on a simple webspace.
  • If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
  • Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Please rate this library. Is it a good library?

Informations about the package laravel-sri

Laravel Subresource Integrity

StyleCI GitHub Workflow Status Latest Version on Packagist Total Downloads

Small Laravel 8+ package that'll generate the integrity hashes for your style and script files.

For Laravel 5.5+ support, use the v1 branch. For Laravel 6+ support, use the v2 branch.

About Subresources Integrity

From MDN:

Subresource Integrity (SRI) is a security feature that enables browsers to verify that files they fetch (for example, from a CDN) are delivered without unexpected manipulation. It works by allowing you to provide a cryptographic hash that a fetched file must match.

Troy Hunt wrote an article speaking on the subject, you can read it here

Installation

This package uses auto-discovery, so you don't have to do anything. It works out of the box.

Config

If you want to make changes in the configuration you can publish the config file using

Content of the configuration

key default value possible values
base_path base_path('/public')
algorithm sha256 sha256, sha384 and sha512
hashes [] (see "How to get a hash)
mix_sri_path public_path('mix-sri.json') (see "How to get a hash)
enabled true
dangerously_allow_third_party_assets false

Usage

To only get a hash, use Sri::hash:

To generate the HTML for the integrity and the crossorigin attributes, use Sri::html. It accepts two parameters:

Blade Component

Alternatively you can use blade components:

If you add a mix attributet to the component it'll use mix() instead of asset() to generate the link to the assets:

Improve performance

You should wrap your <link> and <script> tags with the @once directive to ensure that your tags are only rendered once. This will help with performances as it'll avoid a potential re-hashing of the files (in case you want to hash them on the fly).

Be careful that this should only be use for production as it won't re-render the html tag. Thus preventing new cache busting id to be added to the path by mix.

How to get a hash

Store hashes in the configuration

You can references the assets in the configuration like this:

This means, you have to calculate the hashes yourself. To do this, you can use report-uri.io, mozilla hash generator or any other resource available.

Using a webpack (or Mix) plugin to generate hashes on build

It expect a mix-sri.json file with a similar structure to the mix-manifest.json:

The filename and path can be changed in the configuration at any time.

Self promotion: I made a Laravel Mix extension laravel-mix-sri for this purpose.

Generate them on the fly

If it can't find the asset hash in the config file nor in the mix-sri.json file, it'll generate the hash on each reload of the page.

This method is the least recommended, because it reduce performance and make your page load slower.

Remote resources

This package also work for remote resources. Be careful that resources like Google Fonts won't work.

Contributing

Please see CONTRIBUTING for more details.

License

This project and the Laravel framework are open-sourced software licensed under the MIT license.


All versions of laravel-sri with dependencies

PHP Build Version
Package Version
Requires php Version ^7.3 | ^7.4 | ^8.0
illuminate/support Version ^8.71 | ^9.0 | ^10.0 | ^11.0
Composer command for our command line client (download client) This client runs in each environment. You don't need a specific PHP version etc. The first 20 API calls are free. Standard composer command

The package elhebert/laravel-sri contains the following files

Loading the files please wait ....