- How do I install jenssegers/proxy in a Laravel application?
- Install the core library with composer require jenssegers/proxy; Laravel applications typically also pull in jenssegers/proxy-laravel, which provides the service provider and a session-backed cookie store. After that you configure an upstream URL and add a route or controller that hands the request to the proxy client. Time to a first working call is usually under a day. Pin the exact version and prove it boots on your PHP and Laravel versions in CI before shipping.
- Does jenssegers/proxy support Laravel 10, 11, and PHP 8?
- There is no published support matrix you can rely on: the last tagged release (3.1.0) only raised the minimum to PHP 7.1, and there is no visible release cadence. Compatibility with PHP 8.x and Laravel 9, 10, or 11 has to be executed and evidenced in a time-boxed spike or CI job rather than inferred. If you need a guaranteed-supported path, a small Guzzle-backed client of your own is the lower-risk option.
- How do I configure the upstream URL that requests are forwarded to?
- The upstream is whatever URL you pass into the library's get, post, put, or delete calls, so configuration lives in your code, not in the package. Keep it in a config file as a fixed value or a short allowlist and never assemble it from raw request input. Because the library itself performs no URL validation, the allowlist check has to be written and tested in your own wrapper.
- Is jenssegers/proxy safe to expose publicly, or does it create an SSRF risk?
- It is unsafe to expose whenever the destination URL is influenced by the caller. The package ships no allowlist, scheme restriction, or private-IP blocking, so a user-controlled target turns your route into an open proxy and a textbook SSRF vector. Only use it with a fixed or strictly allowlisted upstream, and enforce host, scheme, and resolved-IP checks inside an owned wrapper. If the upstream must be user-selected, close the evaluation and use a real gateway instead.
- Can I use jenssegers/proxy to get around CORS errors in the browser?
- Yes, in the narrow BFF sense: the browser calls your same-origin Laravel route, Laravel forwards to the upstream, and the response comes back without a cross-origin preflight. The package is not CORS middleware and does not add or rewrite CORS headers for you. It also passes cookies and headers through by default, so strip or sanitize them explicitly before forwarding anything user-facing.
- How are cookies and headers handled when proxying a request?
- With a thin Guzzle wrapper, inbound cookies and headers are forwarded largely as-is, which means user session cookies can leak to the upstream host. In the other direction, upstream Set-Cookie and Location headers can leak back into your origin responses. That default behavior is unsafe for anything user-facing, so build an explicit allowlist of forwarded headers and strip cookies on both legs. Test both directions, including redirects.
- Does jenssegers/proxy handle timeouts, retries, and large responses?
- No. The package enforces no connect or total timeouts, no redirect cap, no retry policy, and no response-size ceiling, so a slow or oversized upstream can pin PHP-FPM workers and buffer entire payloads in memory. Some of this can be supplied through Guzzle request options, but you have to set and test each one yourself. If streaming, large payloads, or sub-second latency are requirements, disqualify the package for that use case.
- What is the difference between jenssegers/proxy and jenssegers/proxy-laravel?
- jenssegers/proxy is the core PHP forwarding library, while jenssegers/proxy-laravel adds the Laravel service provider and a session-backed cookie store. Installing for Laravel therefore means assessing and maintaining two packages rather than one. Scope both together in the same feasibility spike so you do not discover the second package's constraints in production.
- Is jenssegers/proxy still maintained, and what should I use instead?
- It is effectively unmaintained: version 3.1.0 only bumped the PHP floor to 7.1, there are zero dependents, and there is no visible release cadence, so adopting it without forking means shipping a component nobody patches. Common alternatives are nginx proxy_pass, Envoy, an API gateway, or simply a small internal UpstreamClient built on Guzzle or Laravel's HTTP client. Many teams treat this package as a reference implementation and specification rather than a dependency, and budget to recreate retries, instrumentation, and middleware around their own client.
- How do I test a proxy route built with jenssegers/proxy?
- Point the proxy at a local stub upstream, or mock the underlying Guzzle handler, and assert that method, path, forwarded headers, and response status and body pass through correctly. Add explicit tests proving non-allowlisted hosts are rejected and that cookies and unsafe headers are stripped in both directions. Also cover timeout and oversized-response behavior so a slow upstream fails predictably instead of exhausting workers.