- How do I install mrpunyapal/laravel-client-validation in a Laravel app?
- Install the package with Composer, then render its JavaScript in your layout using the @clientValidationAssets Blade directive. Once the assets are in place you can attach rules to a form with the package's Blade directives or the Alpine x-validate attribute. Remote AJAX rules additionally rely on the package's validation endpoint, so review its route, middleware, and throttle settings before going to production.
- Which Laravel versions does laravel-client-validation support?
- The README states compatibility with Laravel 12 and 13, and the badges track PHP and Laravel version support from Packagist. Livewire support is listed for v3 and v4, while Filament is listed for v3 and v5, so check the current support matrix before assuming your exact Filament version is covered. Livewire and Filament integrations ship as separate split packages (mrpunyapal/client-validation-livewire and mrpunyapal/client-validation-filament), so their version constraints can move independently of the core package.
- Does this package replace server-side validation in Laravel?
- No. Client-side validation here is a UX layer only, providing real-time feedback before the request is sent. Your FormRequest rules and Laravel's validator remain the actual enforcement boundary and must stay in place unchanged. Treating x-validate or the client rule set as a security control is a defect, because anything running in the browser can be bypassed.
- Can I reuse the rules from an existing Laravel FormRequest class?
- Yes. The package provides ClientValidation::fromRequest() to extract rules from a FormRequest, which is the highest-leverage way to adopt it incrementally, form by form, without rewriting validation logic. Your PHP class stays the single source of truth and the browser rule set is derived output. This also limits drift risk, since changes you make to the FormRequest flow into the generated client rules rather than being maintained twice.
- How does the Alpine.js integration work with @validateBlur, @validateLive, and @validateSubmit?
- The directive vocabulary is intentionally small: @rules to declare the rule string, @validateLive for input-time checks, @validateBlur for field blur, and @validateSubmit for submit-time checks, plus the x-validate attribute if you prefer Alpine-style markup. Most mid-level Laravel developers can be productive with it in a day. It also supports bail to stop on the first failure per field and hooks such as beforeValidate and afterValidate for custom behaviour.
- Are the remote AJAX rules like unique and exists safe to expose in production?
- The five remote rules send rule names and parameters that originate in the DOM, so the endpoint must not trust them blindly. Add a rule-name allowlist, sanitise parameters, protect the route with your auth middleware, and apply per-user throttling rather than only per-IP. The package's built-in rate limiting defaults to 60 requests per 60 seconds, which is a sensible starting point but still configuration you must tune and verify, along with defined 419 and 429 handling.
- Does it work with Livewire and Filament?
- Yes. Livewire v3 and v4 are supported with automatic version detection and an x-wire-validate integration, and Livewire and Filament ship as separately installable split packages. Filament support is described as a panel plugin with field-level validation, listed for Filament v3 and v5. Confirm your exact Filament version against the current support matrix, since listed versions suggest the coverage may not include every major release.
- How do I verify the 104 client rules actually match Laravel's validator behaviour?
- There is no published conformance suite asserting client and server parity, so plan to build your own regression tests around the rules you rely on. Focus on the tricky cases: regex patterns containing a pipe character, wildcard and nested array field rules, conditional rules, and file rules where the browser cannot inspect content. Running the same payloads through Laravel's validator and the client engine and comparing results is the most direct way to catch drift before users do.
- What is the bundle size of @clientValidationAssets and does it support a strict CSP?
- The package advertises tree-shakeable ES module subpath exports for minimal bundles, but a published gzipped figure for the full directive bundle is not documented, so measure it in your own build before committing. Because it ships a browser bundle, you also need to plan for cache-busting and asset-load failure handling. If you enforce a strict Content Security Policy, verify nonce or hash support for the injected script rather than assuming it works with your headers.
- Can I use this package outside Laravel, for example with React, Vue, or another backend?
- Yes. It is distributed as a standalone NPM package alongside the Composer package and is described as backend-agnostic, working with any backend and offering React and Vue integrations. That said, if your SPA already uses a schema library such as Zod, Yup, or vee-validate, adding this package duplicates validation logic and is probably redundant. The Composer plus Blade path, particularly FormRequest extraction, is where it delivers the most value.