- What does the jpmurray/laravel-nofloc package do?
- It adds a Permissions-Policy: interest-cohort=() header to every HTTP response, which was intended to opt a site out of Google FLoC tracking. It is a small Laravel package focused on that single response-header concern. It does not provide broader privacy compliance, analytics blocking, or consent management.
- How do I install laravel-nofloc in a Laravel app?
- Install it with Composer using composer require jpmurray/laravel-nofloc. Package discovery likely registers the service provider and middleware automatically, but you should confirm middleware registration order in your application. After installation, inspect a response header to verify that interest-cohort=() is present.
- Does laravel-nofloc support Laravel 9, 10, and 11?
- The last release was in April 2021, so compatibility with Laravel 9, 10, and 11 should be proven with a test rather than assumed. Check the package's Composer constraints against your PHP and Laravel versions. If auto-discovery or middleware signatures are incompatible, treat the package as a reference implementation instead.
- Does laravel-nofloc overwrite an existing Permissions-Policy header?
- That is the main functional risk to verify: middleware can either append interest-cohort=() to an existing Permissions-Policy header or replace the whole header. If it replaces the header, other permission directives from your security middleware or proxy could be dropped. Test with an existing Permissions-Policy value and confirm merge behavior before production use.
- Is Google FLoC still used, or should I use browsing-topics instead?
- Google deprecated FLoC and moved toward the Topics API, so interest-cohort=() is a legacy opt-out directive. It can still be useful as a historical compatibility header, but it should not be presented as comprehensive privacy compliance. If you need a current control, evaluate browsing-topics=() in addition to or instead of the legacy directive.
- Does laravel-nofloc work with Laravel Octane and cached config?
- There is no documented evidence of Octane-specific testing, so verify it in your environment. Confirm that service-provider discovery and middleware registration behave correctly with cached configuration. The middleware itself adds no network calls or storage, so runtime overhead should be negligible if it loads correctly.
- How do I test that the Permissions-Policy header is being sent?
- Add a Laravel feature test that makes a request and asserts the exact Permissions-Policy response header. Check that the header appears on normal, streamed, and binary responses if your application uses them. Also test a response that already has a Permissions-Policy header to confirm merge behavior.
- Is laravel-nofloc safe to use in production?
- Runtime and security risk are low because the package only modifies a response header. The larger concern is lifecycle risk: it has few stars, no dependents, and no release since 2021, so maintenance is uncertain. For production, pin the exact version, assign an internal owner, and be prepared to replace it with in-house middleware.
- What are alternatives to laravel-nofloc?
- You can add the directive in a small custom Laravel middleware, which avoids a third-party dependency for a single header. If you already use a security-headers package, CSP layer, or reverse-proxy header policy, add interest-cohort=() there. A CDN or edge configuration can also set Permissions-Policy globally.
- Can I fork or inline laravel-nofloc if it is abandoned?
- Yes. The package is MIT licensed, so you can fork it or copy the middleware logic into your application. Inlining the middleware is often the better path for such a small feature, but you then own the tests and future compatibility. If you fork, document ownership and include it in Laravel upgrade checks.