- Can I use m6web/request-headers-forwarder-guzzle-bundle in a Laravel application?
- No, not directly. It is a Symfony bundle, and Laravel does not use Symfony’s bundle registration and runtime model. The package is also deprecated and archived, so it should be treated as a reference pattern rather than a Composer dependency. Implement equivalent behavior with Laravel HTTP client middleware or a Guzzle middleware.
- What does m6web/request-headers-forwarder-guzzle-bundle do?
- It forwards selected incoming request headers to outbound Guzzle HTTP client calls. The goal is to propagate correlation, trace, tenant, locale, or auth headers across service-to-service requests. It integrates with Symfony request context, not Laravel. In Laravel, replicate the allowlist-based forwarding pattern internally.
- Is this package maintained or safe for production in Laravel?
- It is marked deprecated, archived, and has no upstream maintenance. The last release was in 2017 and it likely has Composer conflicts with modern Laravel, Guzzle 7, and PHP 8+. Production use is not recommended because there will be no security patches or compatibility fixes.
- How should Laravel developers implement header forwarding instead?
- Use Laravel’s HTTP client global middleware or a Guzzle middleware to copy only an explicit allowlist of headers. Keep the allowlist in configuration, not code, and document which headers go to which services under which trust conditions. Start with correlation ID, trace ID, tenant ID, locale, and only trusted auth headers. Add tests for propagation, non-propagation, and leakage prevention.
- Which headers are safe to forward from a Laravel request to Guzzle sub-requests?
- Forward only headers with a clear purpose and trust boundary, such as correlation ID, trace ID, tenant ID, locale, and specific auth headers for explicitly trusted upstreams. Do not blindly forward Authorization, cookies, internal routing metadata, or PII-adjacent headers. Use an allowlist and security-review it before rollout. Enforce header size limits and monitor outbound requests.
- Does this bundle support Laravel 10, Laravel 11, or PHP 8?
- There is no documented Laravel support because it is a Symfony bundle. Its 2017 release predates modern Laravel, Guzzle 7, and PHP 8, so compatibility is unknown and probably poor. You should assume incompatibility and avoid planning production use. Use a current Laravel HTTP client middleware implementation instead.
- Can I install m6web/request-headers-forwarder-guzzle-bundle with Composer in Laravel?
- Composer may resolve it only in an isolated legacy environment, but installation in a modern Laravel app is very likely to conflict. The package is archived with zero dependents and old Symfony and Guzzle constraints. Even if it installs, it creates maintenance and security risk. Do not add it as a dependency; use it only as a design reference.
- What are alternatives to this Symfony bundle for header propagation in Laravel?
- Build a small internal Laravel package or HTTP client middleware with a configured allowlist. A service mesh or API gateway can also handle tracing and correlation headers if that infrastructure exists. For observability, use standards such as traceparent where appropriate. The maintained path is your own tested middleware, not an abandoned Symfony bundle.
- How do I test header forwarding and prevent header leakage in Laravel?
- Write feature tests that assert expected headers are attached to outbound requests and unlisted headers are not. Use Laravel’s HTTP client fake or a Guzzle mock handler to inspect outbound requests. Include leakage tests for Authorization, cookies, tenant identifiers, and internal routing metadata. Roll out behind a feature flag to non-production first.
- Why is header forwarding a security concern for service-to-service calls?
- Forwarded headers can leak credentials, cookies, tenant identifiers, PII-adjacent data, or internal routing metadata to downstream services. The risk depends on whether outbound calls are internal, trusted-partner, or public. Define trust boundaries explicitly and security-review the allowlist. Missing expected headers can also break downstream auth, routing, or tracing.