Laravel Media Viewer Laravel Package

Getting Started

• Install the package with Composer and publish any config if the package exposes one. Start by reading the config for disk mappings, route registration, URL signing/binding, and default response headers.
• First use case: serve a small private file from a local disk through the package route. Confirm the response has Accept-Ranges, Content-Length, correct Content-Type, Content-Security-Policy: sandbox, and Cross-Origin-Resource-Policy.
• Then test two URL modes: stream mode for local/private files, and redirect mode against a disk that supports temporary URLs. Verify Range requests return 206 Partial Content with Content-Range.
• If you serve HLS, test an .m3u8 playlist through the package and verify it receives the same CSP/CORP headers as normal file responses.

Implementation Patterns

• Use stream mode when the app must enforce authorization or when the disk cannot generate temporary URLs. Use redirect mode for S3 or any disk with temporary URL support, especially for large media or non-seekable remote streams.
• For private files, protect the delivery route with auth middleware and generate URLs in the authenticated context when you want them bound to the current user. For public/shareable links, generate URLs in a guest context or use a deliberate public disk/route.
• For HLS, serve playlists through the package so the fixed CSP sandbox and CORP headers apply. Segments can be served as normal file responses or redirected to temporary disk URLs, but keep segment URL expiry aligned with expected playback duration.
• For video/audio, let the browser drive Range requests. With local disks, stream mode is usually fine. With S3/remote disks, prefer redirect mode so the browser talks directly to storage for range handling.
• Integrate by returning the package response from your controller/route, or by using the package’s route helper/macro if available. Apply your own authorization checks before producing the response; URL binding should not replace policy checks.
• Generate user-bound URLs per request/user. Do not cache authenticated URL responses across users unless the URL is intentionally unbound/public.

Gotchas and Tips

• Upgrade to v0.1.1+ if you rely on HLS playlists: older versions did not send the CSP sandbox and CORP headers on playlist responses.
• Redirect mode requires temporary URL support. It works for any disk with temporary URLs, not only S3, but local disks may not support it; fall back to stream mode.
• Range savings are between browser and app. In stream mode, a non-seekable remote stream may be read up to the requested offset, so seeking deep into a remote S3 file can be slow/costly. Use redirect mode for S3.
• URL binding only applies when a user is signed in. Guest-generated URLs are not user-bound, so do not assume a URL generated while signed out is protected by user binding.
• CORP can affect embedding. If a player or site is cross-origin, verify CORP does not block required media/playlist requests.
• Check headers with curl -I, including Content-Range and Accept-Ranges on range requests, and confirm HLS playlists include CSP/CORP.
• Authorization is still your responsibility. Use middleware/policies for private files; URL binding is an additional control, not a replacement.
• Watch HLS URL expiry. Signed segment URLs that expire mid-playback can cause stalls; set TTLs based on expected viewing time.
• Debug disk/config issues first when redirect mode fails: check temporaryUrl support, disk credentials, URL signing config, and route middleware.