P3Pcookiebundle Laravel Package

Getting Started

• Read before you composer require. This is a Symfony2 bundle, not a Laravel package. There is no service provider, no facade, no Illuminate dependency. Dropping it into a Laravel app will either fail on symfony/symfony ~2.x constraints or pull in an EOL subtree. Decide up front: you are reading this repo for the technique, not installing it.
• Read these three files first. Resources/config/services.xml (what gets registered), the event listener class (where the header is actually written), and DependencyInjection/Configuration.php (the configurable knobs). That trio is the entire package.
• The technique in one sentence: old IE/Edge only accepted third-party cookies inside an iframe when the response carried a P3P compact policy header, e.g. P3P: CP="NOI DSP COR NID ADMa OUR IND UNI COM NAV". The bundle attaches that header to responses so session cookies survive in embedded contexts.
• First use case: your Laravel app renders a form or widget inside a partner's iframe and the session cookie gets dropped. You want the header on that response, scoped to that route.
• Minimum working Laravel equivalent — one middleware, no package:

// app/Http/Middleware/P3pHeader.php
public function handle($request, Closure $next)
{
    $response = $next($request);
    $response->headers->set('P3P', 'CP="NOI DSP COR NID ADMa OUR IND UNI COM NAV"');

    return $response;
}

Register it in app/Http/Kernel.php — globally for an embed-heavy app, or as a route middleware alias so you only pay for it where it matters.

Implementation Patterns

• Port the listener, don't port the bundle. The Symfony listener is roughly twenty lines around kernel.response. The Laravel analogue is middleware. Keep the compact-policy string in config/p3p.php (or config/services.php) so ops can change it without a code deploy.
• Scope it narrowly. Add it as a named middleware ('p3p') and attach it to embed/iframe routes only — the moral equivalent of tagging the Symfony listener to specific paths. Global middleware puts a dead-standard header on every JSON, asset, and API response.
• Drive it from config, not constants. The bundle exposes the policy through bundle config; mirror that with config('p3p.compact_policy') and validate the string once at boot. A malformed CP token is silently ignored by IE, which is the worst possible failure mode.
• Pair it with the modern fix. P3P is the IE-only half of the problem. For Chrome/Safari/Firefox the cookie itself needs SameSite=None; Secure — set in config/session.php ('same_site' => 'none', 'secure' => true) or per-cookie on the Cookie facade. Ship both, or your embed works only in IE and nowhere else.
• Test both directions. $this->get('/embed')->assertHeader('P3P') in a feature test, and an assertion that non-embed routes do not carry the header, so a future "just make it global" refactor gets caught in CI.
• Watch the proxy layer. If Varnish/CloudFront caches the embed response, either the header is baked into the cached variant or you get hit/miss inconsistency that presents as an intermittent login bug. Add the header at the origin and confirm with curl -I against the CDN hostname.
• Extension point in the original: the event listener is the seam. In Symfony you'd decorate it or register a competing kernel.response listener at higher priority. If you maintain a hybrid Symfony/Laravel estate, that's where you'd hook rather than editing vendor code.

Gotchas and Tips

• It will not install in Laravel. Symfony2 bundles depend on the Symfony DI container, Bundle classes, and services.xml. Composer refuses or drags in an EOL Symfony 2.x tree. Treat the repo as reference source only.
• Symfony 2 is EOL since November 2018. Any dependency resolution involving this package is a finding in a security audit. Don't leave it in composer.json "just in case."
• IE11 is EOL (June 2022) and Edge is Chromium. The P3P header now buys almost nothing. Keep it only if you have a contractual or long-tail IE population; otherwise spend the effort on SameSite=None; Secure plus a first-party or partitioned-cookie strategy.
• Header syntax is unforgiving. IE wants the literal P3P: CP="..." shape, comma-separated tokens, and it fails closed and silently on typos. Copy a known-good CP string verbatim; don't hand-assemble tokens.
• Duplicate headers. If both your middleware and nginx (add_header P3P ...) set it, you can end up with two values and IE may ignore both. Pick one layer and remove the other.
• Fastest debug loop: curl -sI https://app/embed | grep -i p3p, then DevTools → Network → Response Headers. If it's missing, check middleware ordering in Kernel::$middleware and whether an earlier middleware short-circuits without calling $next.
• Don't reach for a JS cookie shim. If the browser rejects the third-party cookie, script access in the iframe is rejected too. The header (IE) and SameSite/Secure (everyone else) are the only levers you control from the origin.
• Session driver changes the symptom. With database or redis sessions and a dropped cookie, you don't get an error — you get a fresh session per request and phantom logged-out users. Log session()->getId() on embed routes while debugging; a changing ID confirms the cookie is the problem, not auth.
• Config is compile-time in the source bundle. The compact policy is read when the Symfony container compiles, so edits required a cache clear. If you mirror that with a cached config value in Laravel, remember php artisan config:clear in your deploy script.