- Is jmikola/insecure-routes-bundle compatible with Laravel?
- No. It is a Symfony2 bundle that hooks Symfony routing and dependency injection; Laravel does not use bundles or route scheme requirements in the same way. There is no Illuminate support, and installing it would pull Symfony2-era dependencies that conflict with Laravel components. Use Laravel-native middleware, TrustProxies, and environment-gated HTTPS instead.
- How do I install jmikola/insecure-routes-bundle?
- It is installed via Composer into a Symfony2 application and registered as a bundle in the kernel. It is not intended for Laravel, and there is no supported installation path into an Illuminate codebase. For Laravel, implement the equivalent with a small environment-gated middleware or service provider.
- Can I use this bundle to allow HTTP for specific routes in Laravel?
- Not directly. The bundle relaxes HTTPS enforcement inside Symfony's routing layer, while Laravel handles HTTPS through URL generation, middleware, trusted proxies, secure cookies, HSTS, and web-server configuration. Build a Laravel middleware that redirects or denies non-HTTPS requests except in local and testing environments. Keep the environment as the switch, not a runtime config flag.
- What Laravel versions does this package support?
- None. It is a Symfony bundle targeting Symfony2-era routing and container behavior, with no Laravel or Illuminate compatibility. Modern Laravel and PHP versions expect different routing and middleware APIs. Treat it as a reference pattern only, not a dependency.
- How do I test HTTPS enforcement for routes in Laravel?
- Write feature tests that assert HTTPS URLs, secure cookies, redirects, and proxy header handling. Use Laravel's HTTP testing helpers with server variables for scheme and forwarded proto, and add CI checks that fail if HTTPS is relaxed outside local and testing. The Symfony bundle's own tests do not translate to Laravel.
- Is it safe to use insecure-routes-bundle in production?
- No, especially not in Laravel or any production path. It is security-sensitive, targets EOL Symfony2, has very low adoption, and could weaken transport security if accidentally activated. If a legacy Symfony2 service must use it, isolate it to dev and test kernels and require-dev, and verify it cannot activate in production.
- What are alternatives to insecure-routes-bundle for Laravel?
- Use Laravel-native controls: environment-gated URL::forceScheme('https'), TrustProxies for load balancers, HSTS outside local and testing, local TLS via Valet, Herd, or mkcert, and middleware for HTTPS redirects. Keep the environment as the switch rather than a runtime flag. This gives you a small, owned pattern with tests.
- How do I configure insecure routes in Symfony with this bundle?
- You declare selected routes as insecure in Symfony routing configuration, and the bundle's listener lets those routes bypass normal HTTPS enforcement while other routes stay secure. That configuration model is Symfony-specific and does not map to Laravel routes. In Laravel, express the same intent with route groups, middleware, and environment checks.
- Why is this package a poor fit for Laravel?
- Laravel does not use Symfony bundles or route scheme requirements the same way, so the integration surface is poor. Composer installation would pull Symfony2-era routing and container dependencies that conflict with Illuminate components. The portable idea is relaxing HTTPS only in dev and test, which you can implement natively in Laravel.
- Is jmikola/insecure-routes-bundle maintained?
- It is effectively unmaintained for modern stacks, with EOL Symfony2 assumptions and very low adoption. There are zero dependents and minimal community support, so regressions may go unnoticed. Treat it as vendored source or a reference pattern, not a supported dependency for Laravel.