Weave Code
Response Headers Bundle Laravel Package
republique-et-canton-de-geneve/response-headers-bundle
A Symfony bundle for centrally configuring HTTP response headers. Define default, route-specific, or environment-based headers—such as security, caching, and custom headers—in configuration and apply them automatically to responses.
A Symfony bundle to easily send headers in your HTTP response
Frequently asked questions about Response Headers Bundle
- What does the Response Headers Bundle do?
- It is a Symfony bundle that lets you declare HTTP response headers in configuration instead of scattering them across controllers and templates. You define global defaults and optional route-specific headers, and an event listener applies them to outgoing responses automatically. It is typically used for security headers, cache-control policies, and custom metadata that must be consistent across an application.
- How do I install the response headers bundle with Composer?
- Install it with composer require republique-et-canton-de-geneve/response-headers-bundle, then enable the bundle in your Symfony application if your setup does not auto-register it through Flex. After registration, add the bundle configuration under your config directory and clear the cache. Check the repository README for the exact bundle class name and configuration keys used by your version.
- Can I set different response headers for different routes?
- Yes. The bundle supports route-specific header definitions in addition to global defaults, so you can, for example, send strict cache headers on public pages and no-store headers on authenticated routes. The listener resolves which rules apply to the current request and merges them with your defaults. This keeps header logic declared in configuration rather than repeated in every controller action.
- Does this package work with Laravel?
- No. Despite the Composer ecosystem overlap, this is a Symfony bundle that hooks into Symfony kernel events and its configuration system, so it will not run inside a Laravel application. Laravel developers who need the same behaviour should use HTTP middleware that adds headers to the response object. The underlying idea is portable, but the package itself is Symfony-only.
- How do I add security headers to every response?
- Declare the headers you want, such as X-Frame-Options, X-Content-Type-Options, or Referrer-Policy, as global defaults in the bundle configuration. Because they are applied by an event listener on every response, you do not need to touch individual controllers. Some headers, like Content-Security-Policy, still need careful tuning per application, so validate them in a staging environment before rolling out.
- Which Symfony versions does the bundle support?
- Support depends on the version constraint declared in the package's composer.json, so check that file or the Packagist page before installing. The bundle relies on standard Symfony kernel response events, which have been stable for many releases, but you should still confirm compatibility with your framework version. Running composer require in a test branch is the quickest way to see whether your constraints resolve.
- Can I configure different headers per environment, like dev versus prod?
- Yes. Because the bundle is configured through normal Symfony configuration, you can place different values in config/packages/dev, config/packages/test, and config/packages/prod. A common pattern is relaxed security headers or extra debug metadata locally, with stricter policies in production. Symfony's configuration merging and environment overrides apply as usual.
- What happens if my controller already set a response header?
- The listener merges configured headers into the response, so you should confirm the precedence rules for your installed version in the documentation. In practice, headers you set explicitly in a controller are often the ones you want to keep, while the bundle fills in the defaults for everything else. If you need a controller to win, test the behaviour with a functional test before relying on it.
- How do I test that the headers are actually applied?
- Write a functional test using Symfony's WebTestCase and KernelBrowser, make a request to a route, and assert the expected headers on the returned response object. You can also unit test the listener directly by dispatching a response event with a stub response. Covering one route with global headers and one route with overrides gives good confidence without a large test suite.
- How is this different from writing my own kernel.response event listener?
- A custom listener is a few dozen lines of code, but you then own the configuration schema, merging logic, and documentation for it. This bundle centralises that behaviour behind a declarative configuration format, which is useful when several teams share a Symfony codebase. If you only need one or two static headers, a small subscriber may be simpler, so check the repository activity and release history before adopting a dependency.
Weaver
How can I help you explore Laravel packages today?