Laravel Cloudflare Proxies Laravel Package

Product Decisions This Supports

• Security hardening of outbound requests and trusted-proxy handling. The package classifies IP ranges to reject reserved/non-routable addresses. v0.1.1 closes a real gap: carrier-grade NAT (100.64.0.0/10) and documentation ranges were not being rejected on Symfony versions that Laravel 12 permits, because the upstream PRIVATE_SUBNETS constant omits them. This is the difference between an SSRF/egress guard that looks correct in review and one that actually holds in production.
• Framework-upgrade decisions (Laravel 12). The fix exists specifically because Symfony's version-dependent constants were insufficient for the Laravel 12 support matrix. If a roadmap item is "upgrade to Laravel 12," this package's v0.1.1 is the version that removes a silent correctness regression from that upgrade path.
• Build vs. buy for IP-range validation. Writing your own CIDR denylist is a recurring source of subtle omissions (CGNAT and documentation ranges are the classic misses). Adopting a maintained package that tracks these ranges is the lower-risk default; the alternative is owning the range list and the version matrix forever.
• Feature gating and rollout scope. The behavior only applies when refresh is enabled. That makes it a low-blast-radius adoption: teams can ship the package now, leave refresh off, and enable it per-service when egress controls are in scope.
• Use cases: outbound URL fetching and webhook delivery, user-supplied URL previews/imports, trusted-proxy and forwarded-header validation, allowlist/denylist enforcement for internal service calls.

When to Consider This Package

Adopt when:

• You accept user- or tenant-supplied URLs and make server-side requests to them (SSRF exposure).
• You rely on forwarded headers or trusted-proxy configuration and need correct classification of non-routable space.
• You are on, or moving to, Laravel 12 — v0.1.1 is the first release that covers the Symfony versions that support matrix allows.
• You want reserved-range correctness without maintaining a CIDR list yourself.

Evaluate carefully when:

• You do not enable refresh; the fix and much of the value are inert without it. Adopt for the roadmap, not for immediate behavior change.
• You need egress control at the network layer (security groups, service mesh, DNS pinning). This package is application-layer validation and complements, not replaces, that.
• You require a hardened, long-lived API surface. This is a 0.1.x package — expect pre-1.0 churn and pin versions.
• Your stack predates Laravel 12 or pins older Symfony; verify the range coverage on your actual dependency set rather than assuming parity.

Action for current adopters: upgrade to v0.1.1 if refresh is on. This is a patch-level, backwards-compatible correctness fix, not a breaking change — no migration work, no config changes, no API changes.

How to Pitch It (Stakeholders)

To executives: This is a small, targeted security-correctness fix in an opt-in guard that blocks server-side requests to non-public IP space. The prior release relied on a Symfony constant that omits carrier-grade NAT and documentation ranges on the Symfony versions our Laravel 12 target allows — meaning a class of requests we believed were blocked could pass through. v0.1.1 closes that gap. Risk of adopting is low: it is a patch release, it changes no configuration, and it only affects behavior where the refresh feature is explicitly enabled. Recommended decision: upgrade, and treat the package as the maintained owner of IP-range classification rather than building and maintaining that list internally.

To engineering: Patch release, no breaking changes. The runtime refresh path now explicitly rejects 100.64.0.0/10 (CGNAT) and the documentation ranges, because PRIVATE_SUBNETS is incomplete on the Symfony versions Laravel 12 permits. If refresh is enabled anywhere, bump to v0.1.1 and confirm the range set matches your own denylist expectations; if it is disabled, the upgrade is a no-op but still worth taking to stay current. Note the package is 0.1.x — pin the version and re-check range coverage whenever the Laravel/Symfony support matrix moves.