Weave Code
Laravel Caffeine Laravel Package
genealabs/laravel-caffeine
Laravel Caffeine keeps user sessions alive by pinging your app with a lightweight AJAX heartbeat, preventing session timeouts and lost form data when users are inactive. Easy to install and configure for Laravel apps.
Keeping Your Laravel Forms Awake
Frequently asked questions about Laravel Caffeine
- How do I install genealabs/laravel-caffeine in a Laravel app?
- Install it with composer require genealabs/laravel-caffeine. Laravel package auto-discovery registers the service provider and route automatically, so no manual configuration is required for a basic setup. You can optionally publish the config file if you need to adjust timing. Most Laravel-fluent engineers can complete and verify the integration in under a day.
- Which Laravel versions does laravel-caffeine support?
- Release 13.0.0's headline change is Laravel 13 support, which by semver convention suggests the illuminate constraints were moved rather than widened. If your application is on Laravel 11 or 12, pin an explicit compatible version such as ^12.0.3 so a routine composer update cannot drag the framework forward. Confirm the exact framework constraint and minimum PHP version before scheduling any upgrade.
- How does laravel-caffeine prevent session timeouts?
- The package adds middleware that injects a small meta tag and inline JavaScript snippet into HTML responses. That script pings a synthetic GET /caffeine route, which returns 204 and touches the server-side session. This keeps the session and CSRF token fresh so a long-idle form can still submit successfully.
- Can I customize how often laravel-caffeine pings the server?
- Yes. Laravel Caffeine exposes publishable configuration so you can match the heartbeat interval to your application's session.lifetime. Keep the interval comfortably below the session lifetime so an idle but open page refreshes before expiry. The package description lists customizable timing as a core feature.
- Does laravel-caffeine work with a strict Content-Security-Policy?
- Inline script injection will be blocked by a strict Content-Security-Policy unless you allow it via a nonce or unsafe-inline. The technical assessment notes that an external-script mode is not documented, so inline injection may be the only option. Budget CSP work or verify a compatible approach before enabling it on CSP-protected surfaces.
- What happens if the laravel-caffeine heartbeat fails or is blocked?
- If the script is CSP-blocked or the /caffeine endpoint returns 404, pages still render normally and the package emits no error signal. Users typically discover the failure only when a long form submission returns a 419 CSRF error. Any health check or monitoring for the heartbeat is something you must build yourself.
- Which session drivers does laravel-caffeine support?
- The package is designed around Laravel's session middleware, so it can work with the framework's session drivers, but expiry semantics differ between file, database, Redis, and cookie drivers. The assessment flags that the package's CI may not exercise every production configuration. Test against the exact session driver and cache setup you run in production.
- Does laravel-caffeine inject into Inertia, Livewire, or JSON responses?
- The middleware is meant to inject into HTML responses, so it should skip JSON, streamed, and non-HTML payloads, but that behavior must be verified for your stack. Inertia and Livewire partial responses are a specific concern because injecting a snippet into them is meaningless or harmful. Add tests for those response types before enabling it globally.
- Is laravel-caffeine safe behind a CDN, cache, or WAF in production?
- Yes with care. Ensure the /caffeine route and any session-bearing HTML responses are not cached by a full-page cache or CDN, because caching would defeat the session touch. Reverse proxies and WAFs can also drop the keep-alive GET, and the package will not warn you if that happens. Verify the heartbeat end to end in the production topology.
- Is laravel-caffeine actively maintained, and what are the alternatives?
- The repository has a meaningful star count but is effectively maintained by one person, and release 13.0.0 was largely a Laravel 13 compatibility release. There are no listed dependents, so you cannot lean on other projects' production experience. Alternatives include building a small custom heartbeat route and script, which may be preferable if you need stricter CSP control or a wider support matrix.
Weaver
How can I help you explore Laravel packages today?