- How do I install and use the Jodit WYSIWYG editor in a Laravel Blade form?
- Install it with composer require nasirkhan/laravel-jodit; the service provider is auto-discovered so there is nothing to register manually. Add @stack('after-styles') in your layout head and @stack('after-scripts') before the closing body tag, then drop <x-jodit::editor name="content" /> into any form. The component loads the Jodit CSS and JS and binds the field for you. A standard Blade or Livewire app usually reaches a working editor in about half a day.
- Does nasirkhan/laravel-jodit work with Livewire components?
- Yes. Pass wire-model to the component and the editor syncs its content back to your Livewire property. The package auto-applies wire:ignore on the wrapper so Livewire re-renders do not destroy the editor instance, and content is flushed back through the Jodit JS API on a 300 ms debounce. That is the correct pattern for third-party JavaScript in Livewire and removes the usual "editor breaks on re-render" problems. Blade view components and plain Blade use the same code path, so there is no branching cost.
- Which Laravel and PHP versions does laravel-jodit support?
- The package requires PHP ^8.2 and supports Laravel ^11, ^12, and ^13. The only optional dependency is intervention/image-laravel, which is exercised solely when you use server-side resize or crop. There are no database migrations and no assumptions about your models, queues, or cache, which keeps the install blast radius genuinely low.
- How do I publish and configure the laravel-jodit config file?
- Publish the package config with php artisan vendor:publish and select the laravel-jodit provider, then edit the file in your config directory. From there you can override the Jodit CDN asset URLs, toolbar profiles, the upload disk and path, and the middleware guarding the connector route. Because the component reads the config at render time, changing toolbar button arrays or storage settings does not require touching any Blade markup.
- Why is my Jodit editor rendering unstyled or not appearing at all in my Laravel layout?
- The package pushes Jodit assets into the named Blade stacks after-styles and after-scripts, so every layout that renders the component must expose @stack('after-styles') and @stack('after-scripts'). Missing stack directives are the most common first-integration failure, especially in custom or third-party admin themes that ship their own asset pipeline. Check the rendered HTML for the Jodit CSS and JS tags; if they are absent, the stacks are the cause.
- How do file uploads and the file browser work in laravel-jodit?
- The package ships a JoditConnectorController that implements Jodit's filebrowser protocol, exposed through a Route::any() endpoint behind configurable middleware (web and auth by default). Uploads land on a configured disk and path, with the disk defaulting to public, and the MIME allowlist is a string list covering images, SVG, PDF, Office documents, zip, and txt. Throttling and validation were added in v1.3.0. Treat the connector as an application feature rather than a vendor detail, because authorization, MIME enforcement, disk selection, and public URL exposure all become your responsibility once it is enabled, and it is enabled by default.
- Is the Jodit editor output safe from XSS, or do I need to sanitize the HTML myself?
- The package stores whatever the editor produces, and its defaultActionOnPaste setting of insert_clear_html is a client-side convenience that is trivially bypassed. SVG is also in the default allowed_mimes, so any content authored by a non-fully-trusted user should pass through a server-side sanitizer such as HTMLPurifier that you own. This is out of scope for the package and is not documented as a requirement, so plan for it before shipping a public-facing form. For the upload endpoint, review the allowlist and public disk exposure explicitly, since SVG, DOCX, and zip are all parser-attack surfaces.
- Can I self-host the Jodit assets instead of loading them from the unpkg CDN?
- By default the CSS and JS load from unpkg.com at a pinned Jodit version (4.1.16) with no Subresource Integrity attribute, and there is no built-in local vendoring option. You can publish the config and point the asset URLs at locally hosted copies, which is what you want for air-gapped environments or a strict Content Security Policy. Doing so also closes the supply-chain gap created by a hard runtime dependency on a third-party CDN, where a compromise or a version removal would break every page that renders the editor.
- How do I customize the Jodit toolbar buttons in Laravel Jodit?
- Toolbar customization is done in the published config file rather than in the Blade tag. The package supports named toolbar profiles, custom button arrays, explicit separators, and dropdown-friendly controls such as align. Publish the config, define or adjust a profile, then reference it from the component. Because the config is read at render time, you can ship different profiles for different forms without duplicating markup.
- What are the alternatives to laravel-jodit, and is the package actively maintained?
- The realistic risk here is project maturity rather than code quality: a single maintainer, no dependents, and a release history that includes StyleCI-only changes, so plan for the possibility that you end up owning a fork. If you want a more heavily exercised editor, comparable Laravel integrations exist for TinyMCE, CKEditor, and Trix, and the integration surface here is small enough that swapping is largely a view-level change. If you stay with Laravel Jodit, pin the version, vendor the assets, and add your own server-side HTML sanitization and upload review before using it in production.