- What is overtrue/laravel-stateless-session used for?
- It adds a stateless session driver for Laravel that keeps session data in encrypted cookies instead of server-side storage such as Redis, a database, or files. It preserves the normal Laravel session API while letting sessions work across multiple app instances without sticky sessions. Version 3.0 also supports header-based session continuity for cookie-less API, SPA, and mobile clients.
- How do I install overtrue/laravel-stateless-session?
- Install it with Composer using composer require overtrue/laravel-stateless-session. For the Laravel 13 release, the documented command is composer require overtrue/laravel-stateless-session:^3.0 --with-all-dependencies. Your application must already run Laravel 13.x and PHP 8.3 or newer.
- Which Laravel and PHP versions does this package support?
- Release 3.0.0 requires Laravel 13.x and PHP 8.3 or newer, and CI covers PHP 8.3, 8.4, and 8.5. It cannot be adopted incrementally on Laravel 9 through 12 applications; those should stay on an earlier package line if already adopted. Check the package release notes before upgrading a major Laravel version.
- How does the stateless session driver work without Redis or a database?
- Instead of storing session state on the server, the driver keeps the session payload in an encrypted cookie that travels with the request. That removes the need for a shared session backend and avoids sticky sessions when you run multiple containers or serverless instances. Laravel's session API, validation, regeneration, and invalidation behavior remain in place.
- Is it safe to store session data in encrypted cookies?
- The client-side payload is protected by Laravel encryption and the package preserves Laravel's malformed-session-ID validation. You should still follow normal cookie hardening practices, such as HTTPS, secure and HTTP-only cookie flags, and careful APP_KEY management. Do not put sensitive data in the session unless your threat model accepts client-side encrypted storage.
- Do I need sticky sessions or a shared session store with this package?
- No. The package is designed so multiple app instances can serve the same session without sticky sessions or a shared Redis, database, or filesystem session store. That makes it useful for horizontally scaled, containerized, and serverless deployments.
- How do I configure the stateless driver in Laravel?
- Set your Laravel session driver to stateless, following the package's configuration instructions for your version. On Laravel 13, register the documented middleware in the HTTP middleware stack. If you use header-based transport, also configure the request and response header names and expose the response header through CORS.
- Does it keep the normal Laravel session() helper and Session facade?
- Yes. The package is a drop-in session driver, so standard session() helper and Session facade usage continues to work. It changes where session data is stored, not the application-facing session API. Existing code that reads and writes session values generally does not need to be rewritten.
- How should SPA or mobile clients handle the stateless session header?
- Clients should persist the session ID returned in the response header from both successful and rejected responses, and replace it whenever Laravel regenerates or invalidates the session. Configure Access-Control-Expose-Headers for the response header in every cross-origin environment. Clients that only read headers on success or clear state on errors can silently create new sessions.
- What are the main production concerns with overtrue/laravel-stateless-session?
- The biggest constraint is the hard platform jump to Laravel 13 and PHP 8.3+, so Laravel 9 to 12 applications cannot adopt 3.0.0. You must also verify client-side session ID persistence, CORS header exposure, and login/logout regeneration tests. Review cookie size and the maintainer's future Laravel major support policy before relying on it long term.