- How do I install awcodes/filament-oembed in a Laravel Filament project?
- Run composer require awcodes/filament-oembed in the Laravel application that hosts your Filament panel, then publish the package config with the vendor:publish command so provider allow-lists and cache settings can be reviewed. There is no migration, no schema change and no backfill, because the field wraps an existing string column that already stores the URL. Most developers get a first field rendering in well under a day; the real effort is deciding which content types are permitted and who may insert them.
- Which Laravel and Filament versions does filament-oembed support?
- The package's composer.json is the authoritative source, so verify its php and filament/filament constraints against your pinned versions before writing any code. The evaluation flags the Filament major-version pairing as the single most common failure mode in this ecosystem, so confirm the major version before anything else. Value is near zero if Filament is not already your admin UI standard, since this is a Filament form-field add-on rather than a general Laravel oEmbed library.
- How do I add an oEmbed preview field to a Filament form?
- Register the package's field class inside an existing Filament form schema and point it at the string or varchar column that already holds the URL. It renders a responsive media card preview alongside the input, so editors can see what a YouTube, Vimeo or Twitter link will look like before saving. No data migration is required and the underlying record is untouched.
- Can I render oEmbed embed previews in Filament resource tables?
- Yes, the package ships a column API alongside the field API, so the same resolved URL can render as an embed preview in Filament resource tables. The column reads the stored URL the same way the field does, which means you can adopt it in list views without changing persistence. If you already hand-roll iframe markup in custom views, sequence the rollout so you do not run two rendering paths at once.
- Which providers can filament-oembed resolve, and can I add or restrict them?
- The documented examples are YouTube, Vimeo and Twitter, and the provider set is configurable through the published config file. Publish the config and diff it against the defaults in the same pull request, because the allow-list is exactly where an unvetted provider can slip in. That allow-list is also your first line of defence against the outbound fetch behaviour described in the SSRF question.
- Is filament-oembed safe against SSRF from editor-supplied URLs?
- oEmbed resolution typically means your server fetches a third-party URL, so an editor-supplied link that resolves to an internal address turns the admin panel into a request-forgery primitive. Mitigate with a network egress policy plus a strict provider allow-list in the published config; code review alone is not sufficient. Treat this as a deployment concern to settle before exposing the field to non-developer editors.
- What Content Security Policy changes do the oEmbed iframes need?
- Rendered previews are third-party iframes, so your Content-Security-Policy needs frame-src widened for each provider you allow. That is a security-header change that usually requires sign-off from outside the development team. Ship it in the same change as the config allow-list so the two lists cannot drift apart.
- Does filament-oembed cache oEmbed responses, and can I point that cache at Redis?
- This is an open item in the technical evaluation: confirm whether resolution happens server-side, client-side or both, and whether the package exposes a cache layer you can point at Redis. The published config file is where cache settings would live, which is another reason to review it against defaults before merging. Server-side resolution without caching is the scenario that turns a busy admin panel into repeated outbound HTTP calls.
- How do I test a Filament form that uses the oEmbed field?
- Because the field wraps an existing URL column and adds no schema, most form tests stay the same: assert that the field renders and that the stored value round-trips through Filament's form testing helpers. Resolution may perform outbound HTTP calls, so fake or block the HTTP client in your suite rather than hitting live providers. Add at least one test that an unlisted provider is rejected, since the allow-list is the security boundary.
- Is awcodes/filament-oembed still maintained, and what changed in v1.1.1?
- Version 1.1.1 ships with no changelog body, only a compare link between v1.1.0 and v1.1.1, so read the diff before upgrading rather than trusting the patch number. The maintainer appears to be a single individual, so weigh release cadence and issue-response history over the last twelve months against your own risk tolerance. And if you are not running Filament, this package gives you essentially nothing: reach for a general Laravel oEmbed library instead, because this is a thin UI layer over Filament forms and tables.