Referer Cookie Bundle Laravel Package

Product Decisions This Supports

• Attribution model selection (first-touch vs. last-touch). The package captures the inbound Referer header and persists it in a cookie so it survives the gap between landing page and conversion (signup, checkout, lead form). That directly informs whether you can credibly ship first-touch attribution or must settle for last-touch/session-scoped reporting.
• Referral and partner program viability. If you're evaluating an affiliate, B2B2C partner, or "invite a colleague" motion, this is the cheapest possible proof-of-concept for capturing the referring source without standing up a CDP or buying an attribution vendor. Good for a two-week discovery spike, not for a launch.
• Build vs. buy for tracking infrastructure. The package is small enough to read end-to-end, which makes it a useful reference implementation when scoping an in-house attribution service — cookie name, TTL, domain/path scope, and retrieval API are the entire design surface. Treat it as a spec, not a dependency.
• Marketing channel reporting requirements. It defines the minimum data contract (referer URL + timestamp) that your analytics/BI layer needs in order to answer "which channels produce activated users, not just signups."
• Consent and privacy roadmap. Because it is a cookie that persists third-party-origin data, adopting it forces an explicit decision on consent gating, retention window, and whether referer capture belongs behind your CMP — a decision you will need anyway for analytics and ads.

When to Consider This Package

Consider it only as reference material or a throwaway spike:

• You are on Symfony (note: this is a Symfony bundle — despite the Laravel framing, it will not drop into a Laravel app without a rewrite; at ~100 lines, rewriting it is trivial).
• You need a working demo of referer capture in an afternoon to validate a hypothesis with stakeholders before committing engineering time.
• You want a concrete example of cookie scoping and TTL handling to hand to an engineer writing the real thing.

Look elsewhere — or build in-house — if any of the following are true:

• Production dependency. Zero stars, zero dependents, no release since November 2021, MIT-licensed and effectively abandoned. No maintainer response, no security patch path, no PHP 8.2+/Symfony 6+ compatibility guarantee.
• Laravel stack. No service provider, no facade, no config publishing. Integration cost exceeds reimplementation cost.
• Attribution accuracy matters. Client-side referer cookies are unreliable: Referrer-Policy headers strip the value on many sites, Safari/ITP caps script-set cookies at ~7 days (or 24 hours in some contexts), cross-domain journeys break the cookie, and consent banners frequently block the set entirely. Any real attribution program needs a server-side or first-party-domain approach.
• Privacy-sensitive domains (health, finance, minors). Storing referring URLs is arguably personal data under GDPR and squarely in ePrivacy cookie-consent territory. An unmaintained package is the wrong place to inherit that risk.
• You need multi-touch, UTM normalization, or identity stitching. This does none of it.

How to Pitch It (Stakeholders)

Executive summary: This is a small, MIT-licensed, unmaintained Symfony bundle that stores the HTTP referer in a cookie so we can attribute a later signup or purchase to its original source. It is free and technically straightforward, but it has no users, no releases since 2021, and no maintenance — so I recommend it as a design reference and a one-week validation spike, not as a production dependency. If attribution is on the roadmap, the decision in front of us is not "adopt this package" but "do we fund a first-party attribution capability." This package lets us answer that question cheaply, and gives engineering a concrete spec for the roughly 150 lines we would write ourselves.

For engineering: Treat it as a reference implementation of referer capture and cookie scoping. We would reimplement in-house on our own stack, with explicit consent gating, a defined TTL, and a server-side capture path to survive referrer-policy stripping and ITP cookie caps. No vendor lock-in, no abandoned-dependency risk, and the effort is measured in days, not weeks.

Ask: Approve a short discovery spike to measure how much of our traffic actually carries a usable referer before we commit to a referral or partner-attribution roadmap.