Weave Code
Cookie Guard Bundle Laravel Package
freshheads/cookie-guard-bundle
Symfony bundle from Freshheads that adds cookie consent guarding to your app, helping ensure cookies and related scripts only load when visitors permit. Simple Composer install and configuration for PHP projects.
Freshheads Cookie Guard Bundle is a Symfony bundle for adding GDPR-friendly cookie consent to your application. It integrates Cookie Guard so you can define cookie categories and block non-essential cookies, scripts, and embeds until visitors grant explicit permission—without complicating your templates or configuration.
- Configurable consent categories for necessary, analytics, marketing, and custom cookies
- Script and embed blocking until the required consent is given
- Twig integration for consent UI and conditional asset loading
- Persistent consent storage with customizable cookie settings
- Customizable templates to match your site’s design
Frequently asked questions about Cookie Guard Bundle
- Is freshheads/cookie-guard-bundle a Laravel package?
- No, freshheads/cookie-guard-bundle is a Symfony bundle, not a Laravel package. It relies on Symfony DependencyInjection, the Symfony config tree, EventDispatcher, and Twig extension wiring. Laravel has no bundle system, so there is no drop-in installation path. Treat the repository as a reference implementation rather than a Composer dependency.
- Can I install freshheads/cookie-guard-bundle in Laravel with Composer?
- Composer may resolve the package, but it will not integrate with Laravel's kernel, container, configuration model, or view layer. There is no Laravel service provider, config file, facade, or Blade directive included. Adding it as a dependency would create dead code and maintenance risk. Port the small consent-tag-rewriting concept instead.
- How do I port FHCookieGuardBundle to Laravel?
- Extract the small category registry and the client-side logic that promotes inert script tags after consent. Replace the Symfony bundle with a Laravel service provider, a config/cookie-guard.php file, a Blade directive or component such as @cookieGuard, and a published Vite-compatible asset. Expect roughly one to two engineer-weeks including tests, documentation, and CMP compatibility checks. Discard the Symfony DI, config tree, and Twig plumbing.
- Does freshheads/cookie-guard-bundle work with Laravel 10, 11, or 12?
- There is no official Laravel support because this is a Symfony bundle. The archived code targets PHP 7.x and 8.0-era idioms with Symfony 4 and 5 conventions. Any extracted JavaScript or PHP must be re-baselined against your Laravel major version, PHP 8.3 or 8.4, and Vite asset pipeline. Do not assume compatibility from Composer resolution alone.
- Is FHCookieGuardBundle maintained or safe for production?
- The repository is archived, the last release was 2022-11-25, and it has zero stars and zero dependents. There is no security patching, issue triage, or forward compatibility for PHP 8.3, PHP 8.4, or Symfony 7. For compliance-sensitive consent code, unmaintained dependencies are a poor fit. Use your CMP's native blocking or fund an internal Laravel port.
- Which cookie consent manager should I use instead of this bundle?
- Choose based on the CMP already in place, such as Cookiebot, OneTrust, Osano, Klaro, or a custom solution. Most provide native script blocking and category-level consent, which can make this package redundant. Confirm whether the CMP can block external scripts before building custom guard logic. The CMP decision should come before any Laravel porting work.
- Does this bundle handle consent withdrawal and category-level granularity?
- The bundle's model is coarse: it registers consent categories and promotes inert script tags after acceptance. The context flags no evidence that it handles dynamic script injection, SPA navigation, consent withdrawal, or re-consent edge cases. If you need withdrawal behavior or fine-grained categories, validate that against your CMP or implement it explicitly in the Laravel port. Do not assume the archived implementation covers those flows.
- How does the script guarding approach work and what are the CSP issues?
- The pattern renders external scripts as inert script tags with type text/plain and a data-cookie-consent category, then a client-side listener promotes them to live script elements after consent. Inline type text/plain scripts still interact with Content Security Policy, so nonce or hash policies may block them. Test the promoted scripts against your CSP and asset pipeline, especially if you use strict script-src rules. The guard must fail closed so trackers do not load before consent.
- Can I use this bundle in a SPA, Inertia, or Vue app?
- The tag-rewriting approach expects server-rendered script tags in the initial HTML, so it is fragile under SPA route changes and full-page caching. Inertia and Vue apps often inject scripts dynamically after navigation, which the archived listener may not observe. A Blade-rendered Laravel app is a better fit for a port, but still needs tests for route changes and cache behavior. For SPA-heavy apps, prefer CMP-native blocking or a JavaScript consent manager built for dynamic injection.
- How should I test a Laravel port of the cookie guard pattern?
- Test the category config, Blade output for inert tags, consent-grant promotion, denial and no-load behavior, withdrawal and re-consent, CSP nonce or hash handling, Vite asset publishing, and full-page cache or SPA navigation. Include browser tests that fire real CMP consent events and assert no tracker loads before approval. Maintain a compatibility matrix across PHP and Laravel versions. Also verify the failure mode is silent-safe: no pre-consent tracker execution and no broken functional scripts.
Weaver
How can I help you explore Laravel packages today?