- Is kitpages/cache-control-bundle compatible with Laravel?
- No. It is a Symfony2 bundle that depends on Symfony's Bundle class, DependencyInjection extension contract, and kernel.response listener, none of which Laravel uses. Composer may install it because it is PHP-only and MIT-licensed, but it will not register or change response headers in a Laravel application. Treat it as a specification for header behavior, not a package to integrate.
- Can I install kitpages/cache-control-bundle in Laravel with Composer?
- Composer can download it, but installation does not make it work. Laravel has no registerBundles() convention or bundle service-loading mechanism, and the kernel.response event tag is Symfony-specific. You would still need to replace its listener with a Laravel service provider and middleware, at which point the dependency adds no behavior.
- What HTTP headers does kitpages/cache-control-bundle set?
- The documented evaluation extracts the key header contract as Cache-Control: no-cache, no-store, must-revalidate, plus Pragma: no-cache and Expires: 0. The bundle is annotation-driven and can configure Cache-Control, Expires, ETag, and Vary, with public/private, max-age, s-maxage, and no-cache directives. Check the bundle's listener and DI extension source to confirm the exact map and any path allowlist logic before reproducing it.
- How do I implement the same cache-control behavior in Laravel?
- Write a first-party middleware in app/Http/Middleware, for example PreventBrowserCache, that calls $next($request) and sets the extracted headers on the response. Register it globally in bootstrap/app.php for Laravel 11+ or Kernel.php for older versions only if the requirement is truly site-wide; otherwise use a named middleware group on dynamic or authenticated routes. This replaces the Symfony bundle with about 20 lines of Laravel-native code.
- Should I apply no-cache headers globally in Laravel middleware?
- Only if the actual requirement is no browser cache anywhere. A global no-store policy on static assets and API GET responses can disable CDN caching and asset caching, which is usually a defect rather than a feature. Prefer a route-scoped middleware group for dynamic or authenticated surfaces and leave fingerprinted assets and intentionally cacheable endpoints alone.
- Does kitpages/cache-control-bundle support Laravel 10 or Laravel 11?
- No. It is built for Symfony2-era idioms such as FilterResponseEvent and GetResponseEvent, which were removed in Symfony 4.3 and later. Laravel 10 and 11 use Symfony 6 and 7 HTTP components, so a verbatim port would not typecheck. The header strings are wire-stable, but the integration code must be rewritten.
- What are Laravel-native alternatives for ETag, Vary, and Cache-Control headers?
- Use middleware and $response->headers->set() for Cache-Control and Vary, and the underlying Symfony Response::setEtag() or an ETag middleware for conditional GET support. For static asset cache busting, use Vite manifest hashing via @vite or asset() versioning. For CDN invalidation, handle it in the deployment pipeline rather than application code.
- How do I test cache-control headers in a Laravel application?
- Use Laravel's HTTP test helpers to make a request and assertHeader('Cache-Control', ...) on the response. Also verify with curl -I against a running environment to confirm middleware ordering and reverse-proxy behavior. Test route groups separately so a global middleware does not silently affect assets or API GET endpoints.
- Is kitpages/cache-control-bundle maintained and safe for production?
- Runtime risk is low because it only sets headers, but lifecycle risk is high: it is a single-author Symfony2 bundle with no test suite, no CI, three stars, and zero dependents. Any verbatim port will not work against modern Laravel's Symfony 6 or 7 components. If in-house header middleware is permitted, the case for adopting the dependency is essentially zero.
- When should I reject the bundle and harvest it as a spec?
- Reject it as a dependency when you need Laravel behavior, because every line would be replaced by a service provider and middleware pair. Harvest it when you want the literal header contract and any path allowlist logic to inform a first-party implementation. This keeps ownership unambiguous at the next framework upgrade and avoids carrying audit surface for zero runtime behavior.