Weave Code
Referer Cookie Bundle Laravel Package
medelse/referer-cookie-bundle
A Symfony bundle that captures the HTTP referer in a cookie, making referral information persist across requests for attribution, redirects, or analytics.
At a glance
Frequently asked questions about Referer Cookie Bundle
- Can I install medelse/referer-cookie-bundle in a Laravel application?
- No. This is a Symfony bundle, not a Laravel package: it depends on Symfony's Bundle class, DependencyInjection extension, service tagging and the HTTP kernel event system, none of which exist in Laravel's service-provider boot cycle. The only way to run it would be to boot a Symfony kernel alongside Laravel, which is unjustifiable for what amounts to a single cookie write. Treat it as a reference implementation and reimplement the behaviour natively in Laravel.
- How do I reproduce the referer cookie behaviour in Laravel?
- Write a middleware that reads $request->headers->get('referer'), parses the host with parse_url, skips the request when the referer host matches your app host, and then queues a cookie with your configured name, TTL, domain, path, Secure and SameSite values. Move the name, TTL and exclusion rules into config/referer-cookie.php and register the middleware in the web group. Most teams finish this, with tests and a consent gate, in one to two engineering days.
- Does this bundle support Laravel 10, Laravel 11 or PHP 8.2+?
- There is no Laravel support of any kind, and no verified support for Symfony 6 or 7 or for PHP 8.2 and newer either. The last tagged release was 2021-11-26, before several rounds of Symfony bundle directory, services.yaml and event-name deprecations. Expect it to install fine and then fail at container compile time or on a deprecated event.
- What does medelse/referer-cookie-bundle actually do?
- It listens for inbound requests, reads the HTTP Referer header, and persists that value into a first-party cookie. Cookie name, lifetime, domain, path and Secure/SameSite flags are configurable through the bundle's DI extension, and same-host referers are typically excluded so internal navigation does not overwrite the captured value. That is the entire functional surface — there is no reporting, storage layer or attribution model behind it.
- Is this package actively maintained and safe to use in production?
- It shows every sign of being abandoned: last release in November 2021, zero stars, zero dependents, no forks of note and no issue triage or security disclosure process. Medelse is a healthtech company, not a package maintainer, so this reads as an internal utility published once and never revisited. Low adoption also means nobody in the community is watching for a compromised maintainer account, so pinning a commit hash reduces but does not remove the supply-chain risk.
- Is a referer cookie a GDPR or ePrivacy compliance problem?
- Referer values are full URLs, which can contain personal data, search terms or identifiers, so pre-consent capture needs a documented strict-necessary or legitimate-interest analysis in each jurisdiction you operate in. This bundle has no consent hook, so any Laravel port should check your consent state inside the middleware before writing the cookie and expose a kill switch in config. Treat legal and privacy sign-off as a gating step on the ticket, not a follow-up task.
- Why doesn't the referer cookie contain the full landing page URL or UTM parameters?
- Modern browsers default to Referrer-Policy: strict-origin-when-cross-origin, so cross-site navigations send only the origin — no path and no query string. If your product requirement is UTM capture or full landing-page attribution, it will be silently unmet by any referer-cookie approach, including a native Laravel middleware. Only same-origin requests reliably deliver the full URL, and cross-site cookie restrictions plus ITP/ETP further cap first-party cookie lifetimes.
- What cookie attributes should I set when porting this to a Laravel middleware?
- Set Secure and HttpOnly where JavaScript does not need to read the value, use SameSite=Lax by default, scope Domain as narrowly as possible and set an explicit Path and TTL rather than relying on session lifetime. Match the previous behaviour of excluding same-host referers, otherwise internal clicks will constantly overwrite the original attribution. Keep all of these in config so privacy review can shorten the TTL or disable the cookie without a deploy.
- Are there maintained Laravel packages that do the same thing?
- There is no well-known, maintained Laravel equivalent, largely because the logic is a few dozen lines in a middleware and most teams write it themselves. Before building, check whether an analytics or attribution vendor you already pay for — GA4, Segment, a CDP — already captures first-touch referrer data, since purchasing overlap is a good reason to close the ticket. If you do copy code from this bundle, keep the MIT attribution in the file header.
- How do I test referer cookie middleware in Laravel?
- Use feature tests with $this->withHeader('Referer', 'https://example.com/page?utm_source=x')->get('/') and assert the cookie with assertCookie or assertPlainCookie, checking name, value, TTL and flags. Add cases for a same-host referer (no cookie written), a missing header, a malformed referer URL and a request where consent has not been granted. Freeze time with travelTo if the TTL calculation matters to your assertions.
Weaver
How can I help you explore Laravel packages today?