- What does barryvdh/laravel-security actually do?
- The package overview describes a configurable security headers middleware for Laravel that centralizes headers such as X-Frame-Options, X-Content-Type-Options, X-XSS-Protection, Referrer-Policy, and Content-Security-Policy. However, the technical assessment also references Symfony security-core voter integration, creating a documentation and source mismatch. Verify the real behavior against composer.json and src/SecurityServiceProvider.php before relying on either description.
- How do I install barryvdh/laravel-security in a Laravel app?
- Install it with Composer using the package name, then let Laravel auto-discover the service provider or register it manually if needed. Publish the package config file so you can enable, disable, and customize headers without putting policy logic in controllers. Finally, register the middleware globally or assign it to selected routes depending on your hardening scope.
- Which security headers can I configure with this package?
- The documented headers include X-Frame-Options, X-Content-Type-Options, X-XSS-Protection, Referrer-Policy, and Content-Security-Policy. The publishable config file is intended to let you enable, disable, and tune each header per project. Confirm the exact supported set in the source because the package description and assessment are not fully aligned.
- Is barryvdh/laravel-security compatible with Laravel 10, 11, or 12?
- That is not established by the provided context. The assessment notes only 52 stars, zero dependents, and a single maintainer, with essentially no public evidence of successful integration on current Laravel releases. Check composer.json for the Laravel, PHP, and symfony/security-core constraints, and prove compatibility in a disposable branch before booking roadmap time.
- Does barryvdh/laravel-security replace Laravel's built-in security features?
- No. It is described as a lightweight option for adding basic hardening without replacing Laravel's built-in security features. For authorization, Laravel's native Gate and Policy system remains the default mental model unless you have a specific Symfony voter migration constraint. Treat this package as an additive helper, not a replacement for core framework protections.
- Is this package for security headers or Symfony voters?
- The package summary says it provides security headers middleware, while the technical assessment describes a Symfony security-core voter bridge. That contradiction must be resolved before trusting any evaluation or adopting the package. Read composer.json and src/SecurityServiceProvider.php directly rather than relying on the README or package blurb.
- How do I apply the middleware only to selected routes in Laravel?
- Register the middleware as route middleware rather than globally, then attach it to specific route groups or named routes in your routes files. This lets you harden HTML responses while avoiding unnecessary or disruptive headers on APIs or third-party callbacks. If you apply it globally, verify that CSP and frame options do not break embedded or admin workflows.
- Is barryvdh/laravel-security safe to use in production?
- The risk depends on which behavior is real. Header middleware is relatively low risk if configured and tested carefully, but an authorization-critical voter bridge is high risk because defects can fail open or over-deny silently. The package has a single maintainer and low adoption, so check releases, commits, tests, advisories, and fail-closed defaults before production use.
- How can I test that the security headers are working?
- Write Laravel feature tests that assert the expected headers on representative responses, including HTML pages, API routes, and error pages. You can also inspect responses with curl -I or browser developer tools after deployment. For Content-Security-Policy, test real pages for blocked scripts, styles, fonts, and images before enforcing a strict policy.
- What are alternatives to barryvdh/laravel-security?
- For headers, you can use custom Laravel middleware, web server or CDN configuration, or a dedicated package such as spatie/laravel-csp for Content-Security-Policy. For authorization, Laravel's native Gate and Policy features are the standard choice unless you have existing Symfony voters that must be preserved. Evaluate alternatives against your actual use case, because this package's documentation and source behavior appear inconsistent.