Download the PHP package fanfanfw/landbot-secure without Composer
On this page you can find all versions of the php package fanfanfw/landbot-secure. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.
FAQ
Example:
In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
- Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
- To use Composer is sometimes complicated. Especially for beginners.
- Composer needs much resources. Sometimes they are not available on a simple webspace.
- If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
- Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Informations about the package landbot-secure
fanfanfw/landbot-secure
fanfanfw/landbot-secure is a Laravel package that hardens Landbot widget embedding by hiding the original configUrl behind a session-bound proxy flow.
It does not modify the bot logic inside Landbot. It only changes how the browser obtains the config needed to bootstrap the widget.
What It Solves
Landbot's default embed snippet exposes a public configUrl in browser source. If someone copies that URL, they can attempt to reuse the same bot elsewhere.
This package reduces that risk by:
- Keeping the original
LANDBOT_CONFIG_URLserver-side only - Issuing a short-lived one-time token via a Laravel
websession - Exposing a local Laravel config endpoint that the Landbot SDK can fetch
- Proxying the upstream Landbot config through Laravel only after token validation
Security Boundary
This package is a hardening layer, not DRM.
- It hides the original
configUrlfrom HTML and bootstrap JavaScript. - It does not make the proxied config payload impossible to inspect in a legitimate browser session.
- It does not protect against XSS on the host application.
- It does not replace a native vendor-side domain restriction feature.
Requirements
- PHP
^8.1 -
Laravel
^10.0|^11.0|^12.0|^13.0Host PHP minimum still follows the Laravel version you install: - Laravel 10: PHP 8.1+
- Laravel 11-12: PHP 8.2+
- Laravel 13: PHP 8.3+
Installation
Add your Landbot config URL to .env:
Render the widget:
Validate the setup:
Configuration
You may publish the config file:
Available environment variables:
| Key | Required | Default | Description |
|---|---|---|---|
LANDBOT_CONFIG_URL |
Yes | — | Original Landbot config URL |
LANDBOT_ENABLED |
No | true |
Enable or disable the widget |
LANDBOT_ROUTE_PREFIX |
No | __landbot |
Internal route prefix |
LANDBOT_TOKEN_TTL |
No | 2 |
Token lifetime in minutes |
LANDBOT_RATE_LIMIT |
No | 10 |
/token requests per minute per IP |
LANDBOT_LOGGING |
No | true |
Enable package logging |
LANDBOT_LOG_CHANNEL |
No | null |
Optional Laravel log channel |
Usage
Basic usage in any Blade view:
Optional facade usage:
Publishable Assets
Publish config:
Publish views:
How It Works
- The browser lazily requests
GET /__landbot/token. - Laravel stores a hashed one-time token in the session and returns the raw token.
- The browser initializes
Landbot.Livechatwith a same-origin local config URL such as/__landbot/config?token=.... - The Landbot SDK fetches that local config endpoint with the browser session attached.
- Laravel validates the session-bound token, fetches the upstream Landbot config, and returns proxied JSON while keeping the original upstream
configUrlhidden.
Testing
License
MIT
All versions of landbot-secure with dependencies
illuminate/console Version ^10.0|^11.0|^12.0|^13.0
illuminate/http Version ^10.0|^11.0|^12.0|^13.0
illuminate/routing Version ^10.0|^11.0|^12.0|^13.0
illuminate/support Version ^10.0|^11.0|^12.0|^13.0
illuminate/view Version ^10.0|^11.0|^12.0|^13.0