Weave Code
Laravel Cookies Consent Laravel Package
scify/laravel-cookies-consent
A ready-to-use cookie consent solution for Laravel: display a customizable consent banner, manage cookie categories, log user consent, and restrict scripts until approval. Includes middleware, Blade views, config options, and multi-language support for GDPR-friendly compliance.
A Laravel package that provides a Cookies consent floating window and publishes the Cookies for all consent categories
Frequently asked questions about Laravel Cookies Consent
- How do I install and configure scify/laravel-cookies-consent?
- Install it with Composer, then publish the config, assets, translations and Blade components using the package's publish commands. Drop the provided banner component into your main layout so it renders on every page. No Node build step is required by your application because the JavaScript bundle ships pre-compiled. After publishing, review the config options for categories, cookie lifetime and locale before going live.
- Which Laravel versions does this cookie consent package support?
- It is a conventional Laravel package built around a service provider, publishable config, Blade views, routes and translation files, so it fits the normal Laravel request lifecycle rather than requiring extra infrastructure. That structure works across recent Laravel releases, and the package uses the web middleware group plus X-XSRF-TOKEN handling. Always confirm the exact framework constraint in the package's composer.json before upgrading to a new major Laravel version. Older releases published assets and language files to different paths, so check the upgrade notes when moving between versions.
- How do I customize the cookie consent banner design?
- Publish the package's Blade views and edit the markup directly, or override the view from your own resources/views directory. If you fork or heavily customize the banner markup, you must keep the root attributes such as data-cookie-lifetime, data-cookie-categories, data-required-categories and data-csrf-token in place when you upgrade. Those attributes drive erasure, lifetime and the server-side consent save, so removing them causes silent degradation rather than an error. Re-publishing and manually reconciling your custom banner is the safest path after each package update.
- Can the package block scripts and cookies until consent is given?
- Yes. Scripts can be restricted until the visitor approves the relevant cookie category, and the consent categories are configurable so you can map analytics, marketing or other first-party cookies to their own groups. The banner only closes after the selection is posted to the server and persisted, which keeps the UI state and the audit trail in agreement. Required categories are excluded from rejection, so essential cookies keep working.
- Where is user consent stored and logged?
- When a visitor saves a selection, the browser posts it to POST /guard-settings/save, the server validates and persists it, and then the banner closes. That server-authoritative flow means the stored consent record matches what the visitor actually chose. The consent cookie itself is governed by the cookie_lifetime attribute, where 0 means session-only. Because the save route is now behind the web middleware group with CSRF protection, requests must include a valid token.
- Does it work with Inertia, Livewire, and Turbo or other SPA-style apps?
- Yes, the package was designed to compose with modern Laravel front ends. It uses the web middleware grouping plus X-XSRF-TOKEN handling, so consent saves work in Inertia, Livewire and Turbo apps that do not do full page reloads. That is a meaningful improvement over packages that assume classic page navigation. If you wrap or replace the banner with your own SPA component, make sure it still posts to the same endpoint with the CSRF token.
- Why do I get 419 errors on /guard-settings/save after upgrading?
- CSRF enforcement is now applied to the consent save route, which was previously registered without middleware. Any in-house code that posts to that route, such as a custom banner, SPA wrapper, test harness or QA script, will start receiving 419 responses unless it sends a valid token. Laravel's same-origin exemption can soften this in some versions, but do not rely on it. Update custom clients to include the CSRF token, which the banner exposes through data-csrf-token.
- How do cookie lifetime and rejection/erasure behaviour work?
- The data-cookie-lifetime attribute now actually controls the browser-side consent cookie, and a value of 0 makes it session-only. On rejection, the package erases cookies by walking the host and parent domains down to the registrable domain, and required categories are excluded from rejection. These are compliance-relevant behaviour changes rather than API breaks, so have a privacy owner sign off. Stale published markup will not throw an error; it simply erases nothing and hardcodes 365 days, so re-publish and reconcile before assuming you are compliant.
- Is this a full CMP, and when should I choose an alternative?
- No, the scope is deliberately narrow: a cookie consent banner for first-party cookies with categories, logging, script restriction and multi-language strings. It is not a tag manager and does not provide vendor registries, consent receipts or TCF/IAB support. Teams that need those capabilities will outgrow it and should evaluate a dedicated consent management platform. Teams that need a GDPR-shaped banner inside a standard Laravel app will find it sufficient.
- Is the package well tested and maintained?
- Test coverage is solid: the suite grew to 60 Pest tests and 51 JavaScript tests on node:test, with 100% line coverage of the front-end bundle, including a view-override test. The release also fixed several places where behaviour did not match the documentation, so audit what your currently installed version actually does before treating an upgrade as a routine minor bump. Watch the maintenance notes for path changes, such as translations moving to lang/vendor/cookies_consent/ and the locale rename from se to sv, which fails soft and is easy to miss.
Weaver
How can I help you explore Laravel packages today?