Download the PHP package revolution/laravel-fetch-metadata without Composer
On this page you can find all versions of the php package revolution/laravel-fetch-metadata. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.
Download revolution/laravel-fetch-metadata
More information about revolution/laravel-fetch-metadata
Files in revolution/laravel-fetch-metadata
Package laravel-fetch-metadata
Short Description Fetch metadata middleware for Laravel
License MIT
FAQ
Example:
In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
- Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
- To use Composer is sometimes complicated. Especially for beginners.
- Composer needs much resources. Sometimes they are not available on a simple webspace.
- If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
- Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Informations about the package laravel-fetch-metadata
Fetch metadata middleware for Laravel
https://developer.mozilla.org/en-US/docs/Glossary/Fetch_metadata_request_header
Overview
Laravel Fetch Metadata is a security-focused middleware package that validates Sec-Fetch-* HTTP headers to protect your Laravel applications from CSRF attacks and unwanted cross-site requests. The package provides four specialized middleware classes that examine browser-generated fetch metadata headers, allowing you to control which types of requests are permitted based on their origin, mode, destination, and user interaction status.
By leveraging the browser's built-in security features, this package helps prevent malicious requests from unauthorized origins while maintaining a seamless experience for legitimate users.
Requirements
- PHP ^8.2
- Laravel ^11.x
Installation
Uninstall
(Optional) Add middleware alias to bootstrap/app.php
You can use only some of the middleware.
The alias name is arbitrary and can be shortened.
Usage in routing
Default behavior only allows same-origin and none(user-originated operation).
You can specify allowed values via middleware parameters.
You can also use multiple middleware parameters.
When not using an alias.
Usage Examples
This section demonstrates common use cases for the Sec-Fetch-Site and Sec-Fetch-Mode middleware with practical examples.
Sec-Fetch-Site Examples
The Sec-Fetch-Site header indicates the relationship between the request initiator's origin and the target's origin. By default, this middleware allows same-origin and none (user-initiated requests).
Basic protection for sensitive operations:
Allow cross-site requests for public APIs:
Restrict to same-origin only:
Allow same-site requests (subdomains):
For more information about Sec-Fetch-Site values, see the MDN documentation.
Sec-Fetch-Mode Examples
The Sec-Fetch-Mode header indicates the mode of the request. By default, this middleware allows navigate and cors requests.
Protect forms from programmatic requests:
Allow CORS requests for API endpoints:
Restrict to navigation only:
Allow all request modes:
Combining multiple middleware:
For more information about Sec-Fetch-Mode values, see the MDN documentation.
Sec-Fetch-User Examples
The Sec-Fetch-User header indicates whether the request was initiated by user interaction. This middleware can be used to reject requests that are not initiated by user interaction, thus preventing automatic scraping and bot requests.
⚠️ Warning: Using Sec-Fetch-User will also block search engine crawlers, so caution is advised when implementing it on public pages that need to be indexed.
Protect sensitive operations from automated requests:
Prevent automated form submissions:
Protect API endpoints from scraping:
Combining with other middleware for enhanced security:
For more information about Sec-Fetch-User values, see the MDN documentation.
Error Handling
When Sec-Fetch value is invalid, throw the Symfony\Component\HttpKernel\Exception\BadRequestHttpException
You can change the response in bootstrap/app.php.
LICENSE
MIT
