Laravel Nofloc Laravel Package

Product Decisions This Supports

• Privacy posture as a shippable feature, not a policy page. The package is a one-line middleware that sets Permissions-Policy: interest-cohort=() on responses. As a PM, the decision it informs is whether "we opt users out of ad-tech cohort tracking" is a claim you make in marketing and a checkbox in a compliance review — and whether it's enforced by code or by promise. Code-enforced wins.
• Build vs. buy is a false binary here — the answer is "build, it's 15 lines." The entire value is a single header on a single response path. That makes it a pattern to copy, not a dependency to install. The product decision is to add a response-header middleware to our own base middleware stack, and to treat "privacy response headers" as a standing line item in our web app baseline (alongside HSTS, CSP, X-Content-Type-Options).
• Roadmap relevance is historical, not forward-looking. Google's FloC was retired and superseded by the Topics API, and FloC never shipped broadly outside Chrome trials. So this package does not close a current threat vector. It belongs in the roadmap as precedent: if we commit to privacy-differentiated positioning, we need a mechanism (middleware + automated header assertions in CI) for shipping these commitments fast, because the ad-tech landscape changes faster than our release cadence.
• Compliance/audit use case. Useful as a citation in a security questionnaire or DPA appendix answer of the form "we send interest-cohort=()". Cheap credibility signal, zero runtime risk — but only if we actually send the header, which means owning the code rather than depending on an unmaintained package.
• Do not put this in the procurement or vendor-review funnel. Twelve stars, zero dependents, no release since April 2021 — that is not a supply-chain asset, it's a snippet with a composer.json attached.

When to Consider This Package

Consider it (or, more accurately, consider copying its 15 lines) when:

• You maintain a Laravel app and want a response-header hook that runs globally without touching controllers — Laravel middleware is the right shape for this and the package demonstrates it correctly.
• You have a written privacy commitment (public statement, enterprise contract, or internal policy) that needs to be backed by an observable technical control rather than a PDF.
• You're assembling a defensive header baseline and want a checklist item that costs nothing to include.
• You need a worked example to show an engineer who hasn't written global middleware before.

Look elsewhere — or rather, look at the pattern and move on — when:

• You need maintenance. Last release 2021, no dependents, single maintainer. Any dependency you add needs an owner and an update path; this has neither. Given the header value is a constant string, composer require is strictly worse than php artisan make:middleware.
• You are treating this as current ad-tracking mitigation. It is not. FloC is dead. If your actual concern is Topics API, cohort assignment, or third-party cookie deprecation, this package does nothing for you and you need a fresh evaluation of what the current browser APIs actually expose.
• You're on a non-Laravel stack. The underlying idea is framework-agnostic; the package is not.
• You need guarantees. No tests you can audit against your requirements, no security policy, no changelog discipline. For a header this simple that's tolerable in copied code and unacceptable as a pinned dependency in a regulated environment.

How to Pitch It (Stakeholders)

For executives: This is a small, MIT-licensed Laravel add-on that sends one HTTP response header telling Google not to include our visitors in its FloC ad-cohort tracking. The concept is right and the implementation is trivial. Two caveats: FloC has since been discontinued by Google, so this specific header no longer neutralizes a live threat; and the package itself is a 2021 one-person project with no adoption and no maintenance. Recommendation: do not take it on as a dependency. Instead, we adopt the pattern — a global response-header middleware we own — which gives us the same privacy signal, plus the ability to extend it to whatever replaces FloC, with no supply-chain exposure and no maintenance question. Cost is measured in hours, not sprints.

For engineering: The whole package is a middleware that appends Permissions-Policy: interest-cohort=() to outgoing responses, registered in the HTTP kernel. We should write our own equivalent into the base middleware group, add a feature test asserting the header is present on a representative route, and fold it into the existing security-headers middleware if we already have one rather than adding a second class. Note the header syntax has evolved (interest-cohort was the FloC-specific token; current Permissions-Policy grammars use different directive names), so if we ship this we should ship it alongside a review of what our headers actually need to say today — the value here is the mechanism and the precedent, not the literal string.