laravel-feature-policy maintained by codebar-ag
Build and apply Permissions-Policy (formerly Feature-Policy) headers in Laravel applications.
Requirements
- PHP 8.3, 8.4, or 8.5
- Laravel 13
Installation
composer require codebar-ag/laravel-feature-policy
Publish configuration (optional):
php artisan vendor:publish --tag=laravel-feature-policy-config
Configuration
The published config file is config/feature-policy.php. You can also rely on environment variables:
| Env | Config key | Default | Purpose |
|---|---|---|---|
FPH_ENABLED |
enabled |
true |
Master switch; when false, middleware does not apply policy headers. |
| — | policy |
null |
Fully qualified class name of your policy (must extend CodebarAg\LaravelFeaturePolicy\Policies\Policy). |
FPH_PROPOSAL_ENABLED |
directives.proposal |
false |
Enable proposed directive group. |
FPH_EXPERIMENTAL_ENABLED |
directives.experimental |
false |
Enable experimental directive handling. |
FPH_REPORTING_ENABLED |
reporting.enabled |
false |
Add Reporting-Endpoints and related reporting metadata. |
FPH_REPORT_ONLY |
reporting.report_only |
false |
When reporting is on, also emit Permissions-Policy-Report-Only. |
FPH_REPORTING_URL |
reporting.url |
(see config) | Endpoint URL for violation reports. |
Implement a policy class with a configure() method that calls addDirective() (see package tests and Policies\Policy).
Middleware
Register the middleware on your web stack (or another group), for example in bootstrap/app.php:
use CodebarAg\LaravelFeaturePolicy\AddFeaturePolicyHeaders;
$middleware->web(append: [
AddFeaturePolicyHeaders::class,
]);
You may pass a specific policy class as a middleware parameter:
Route::get('/admin', AdminController::class)
->middleware(AddFeaturePolicyHeaders::class.':'.AdminPermissionsPolicy::class);
Quality checks
Run Laravel Pint in test mode:
composer lint
Run static analysis (PHPStan + Larastan):
composer analyse
Run the test suite:
composer test
Run tests with code coverage and a 100% minimum (requires the PCOV or Xdebug PHP extension):
composer test-coverage
Run lint, analysis, and tests together:
composer quality
Credits
This package was initially inspired by mazedlx/laravel-feature-policy (MIT). The implementation has since been significantly adapted for Laravel 13 and is maintained independently by codebar-ag.
License
MIT