Laravel Nofloc Laravel Package

Getting Started

• composer require jpmurray/laravel-nofloc. The package is tiny — one middleware class plus a service provider — so installation is effectively the whole setup. Service provider auto-discovery works on Laravel 5.5+; older apps register Jpmurray\LaravelNoFloc\LaravelNoFlocServiceProvider in config/app.php.
• Open the README first, then src/. There is no config file to publish and nothing to migrate. The only decision you make is where to attach the middleware.
• Register the shipped middleware (typically Jpmurray\LaravelNoFloc\Http\Middleware\NoFloc — confirm the exact namespace from the README of the installed version) in app/Http/Kernel.php under web, not the global $middleware stack. It only needs to touch browser-facing HTML responses.
• First use case: you want Permissions-Policy: interest-cohort=() on every page without writing a middleware yourself. Install, register in web, then curl -sI https://yoursite.test | grep -i permissions to confirm the header is present.
• If you only have one or two routes to cover, attach the middleware directly to those routes rather than the whole web group.

Implementation Patterns

• Attach to the web group, not global middleware. You do not want the header on API JSON, health checks, or static asset responses served through Laravel — it is noise and, in some strict proxy setups, can trip header-merge warnings.
• Verify in a feature test, not just manually. $this->get('/')->assertHeader('Permissions-Policy', 'interest-cohort=()'); catches the common failure where the middleware was registered in the wrong stack.
• Consolidate with your other security headers. Most apps already have a middleware setting X-Frame-Options, Referrer-Policy, Strict-Transport-Security, etc. Adding a second one-header middleware for a deprecated header is more moving parts than it's worth — fold the Permissions-Policy line into your existing header middleware and drop the dependency.
• Set it at the origin, then let the edge pass it through. The middleware only affects responses generated by Laravel. If you terminate TLS at Cloudflare, Fastly, or an ALB that has its own response-header rules, confirm the header survives the round trip.
• For subdomains and multi-tenant apps, add the middleware to each HTTP kernel group that serves HTML, or push it down to a base controller/middleware trait so every tenant picks it up.
• Pair it with a header-audit test you already run (e.g. assertHeader on a homepage smoke test) so a future refactor of Kernel.php doesn't silently drop the header.

Gotchas and Tips

• FLoC was abandoned in early 2022. Google replaced it with the Topics API, and the interest-cohort=() opt-out is a no-op on today's Chrome. The package still works as advertised; it just doesn't buy you anything in 2024+. Treat it as historical, not protective.
• Header name matters. The current spec is Permissions-Policy (singular). The older Feature-Policy: interest-cohort=() is a different header and is ignored by browsers that implement the modern policy. If you see Feature-Policy in your output, something else is setting it.
• Middleware ordering and clobbering. If any other middleware calls $response->headers->set('Permissions-Policy', ...) unconditionally, whichever runs last wins. There is no merge logic in this package. Search your codebase for Permissions-Policy before adding this one.
• Stale caches hide the fix. If your CDN or Laravel's HTTP cache holds pre-install HTML, the header will be missing even though the middleware is registered. Purge edge cache and php artisan cache:clear before concluding the package is broken.
• The package is effectively unmaintained: last release April 2021, ~12 stars, zero dependents. Check composer.json constraints against your Laravel version — Laravel 9/10/11 may not be in the supported range, and auto-discovery may still register but with deprecation warnings. If it doesn't install cleanly, write the five-line middleware yourself.
• No extension points. There's no config to publish, no events, no conditional logic for environment. If you need "only in production" or "only on HTML responses", you're wrapping or replacing the middleware anyway.
• Debugging checklist when the header is missing: (1) php artisan route:list --middleware to confirm the middleware is on the route; (2) php artisan config:clear after editing Kernel.php; (3) curl a route that actually goes through the web group, not a queue or console path; (4) inspect $response->headers->all() in AppServiceProvider::boot() temporarily to see whether something is overwriting it downstream.