Weave Code
Laravel Proximage Laravel Package
coderello/laravel-proximage
Proximage lets you resize, crop, and manipulate images on the fly by simply tweaking their URLs—no pre-generated thumbnails needed. Includes caching, signed URLs, and placeholder support for fast, flexible image handling in Laravel.
Image proxy for Laravel.
Frequently asked questions about Laravel Proximage
- How do I install coderello/laravel-proximage?
- Require the package via Composer, publish its config file with the vendor:publish command, and use the proximage() Blade helper in your templates. It registers a route and middleware automatically, so there is no sidecar service or infrastructure change. Expect roughly a day of work for a happy-path proof of concept, with dependency version checks being the first task.
- Which Laravel and PHP versions does laravel-proximage support?
- The last release was on 2020-11-18, which places it in the Laravel 8 era, and it pins an intervention/image v2-era API alongside Guzzle. Support for Laravel 9, 10, 11 and PHP 8.1+ is unverified and unlikely to be maintained. Verify the composer constraint set against your PHP and Laravel versions before committing, and expect to either pin an older framework or fork the package.
- How does caching work in laravel-proximage?
- It is a pull-through cache: the first request for a transformed image fetches the upstream source, resizes or crops it, and writes the result to a configured filesystem disk. Later requests serve the cached file. For multi-node deployments the disk must be shared across all web workers, and you should confirm cache key, TTL, and invalidation semantics in code. Every cache miss is a synchronous outbound HTTP fetch plus CPU-bound encoding inside a PHP worker.
- Does laravel-proximage protect against SSRF?
- A proxy that fetches a caller-supplied URL is an SSRF vector by construction, exposing internal metadata endpoints, localhost services, and private ranges. Do not assume protections from the README; verify in code whether it enforces a host allowlist, blocks private and link-local ranges, caps redirects, and validates content type and source byte size. Most of that hardening likely has to be added by you before production use.
- Can anyone abuse my Proximage endpoint as a free image resizing service?
- Yes. If proxy URLs are unsigned and public, third parties can generate arbitrary transforms against your origin, burning CPU and memory on your workers. Check whether the package signs or tokenizes URLs by default and enable signing if it does not. Also cap source byte size, output dimensions, and allowed MIME types so a single crafted request cannot degrade the worker pool.
- What image operations does Proximage support?
- It resizes, crops, and manipulates images on the fly by tweaking URL parameters, re-encoding through intervention/image. There are no pre-generated thumbnails to manage, and the package also includes caching, signed URLs, and placeholder support. Transformation capability is bounded by the pinned intervention/image version, so advanced filters may require an upgrade path you do not have.
- Can I use laravel-proximage with S3 or multiple app servers?
- The cache writes to a configured filesystem disk, so a local disk works for a single server and S3 works if all nodes share it. Running multiple app nodes behind a load balancer without a shared cache disk defeats the cache and multiplies cache misses. Confirm shared-disk behaviour before deploying horizontally.
- Is coderello/laravel-proximage still maintained?
- It is a single-maintainer package with roughly 157 stars under the MIT license, and its last release was on 2020-11-18. Treat it as a take-ownership dependency: you will either fork it or accept a frozen artifact. The license and code provenance are clean enough for an internal fork, but budget for that maintenance.
- What are the alternatives to laravel-proximage?
- If you need on-the-fly transforms beyond a PHP monolith, Glide, imgproxy, Thumbor, and Cloudflare Images are the usual replacements. The package's main advantage is avoiding new infrastructure inside a server-rendered Laravel app on Laravel 8 or earlier. If you are on Laravel 10/11 or already have a CDN doing transforms, that core value disappears. Keep the call site isolated behind the proximage() helper so swapping later is cheap.
- How do I use the proximage() helper in Blade?
- Call proximage($url, [...]) with the remote image URL and an array of transformation options such as resize and crop parameters. The helper outputs a URL pointing at the package's proxy route, which performs the transform and serves the cached result. Using it as the single call site keeps the package easy to replace with a CDN or imgproxy later.
Weaver
How can I help you explore Laravel packages today?