Laravel Disable Floc Laravel Package

Getting Started

Minimal Setup

1. Installation:

   composer require spatie/laravel-disable-floc
   

   The package auto-discovers Laravel 5.5+ and requires no manual registration.

2. First Use Case:

   • Immediately disables FLoC for all users by default. No configuration is needed out of the box.
   • Verify via browser DevTools (Network tab) that the Permissions-Policy header includes interest-cohort=():

     Permissions-Policy: interest-cohort=(), geolocation=()
     

3. Where to Look First:

   • README for core functionality.
   • config/floc.php (auto-generated) for customization options.

Implementation Patterns

Core Workflow

1. Default Behavior:

   • Automatically injects interest-cohort=() into the Permissions-Policy header via Laravel’s middleware stack.
   • Works globally across all routes unless overridden.

2. Conditional Disabling:

   // Disable FLoC only for specific routes
   Route::middleware(['web', DisableFloc::class])->group(function () {
       // Routes where FLoC is disabled
   });
   

3. Dynamic Control:

   • Use middleware to conditionally disable FLoC per request:

     public function handle(Request $request, Closure $next)
     {
         if ($request->user()->shouldDisableFloc()) {
             app(DisableFloc::class)->disable();
         }
         return $next($request);
     }
     

4. Integration with Existing Headers:

   • Extend the Permissions-Policy header without conflicts:

     // In AppServiceProvider boot()
     $this->app[DisableFloc::class]->addToHeader('geolocation=()');
     

Advanced Patterns

• Custom Headers:

  // Disable FLoC and add CHIPs header
  DisableFloc::addToHeader('interest-cohort=(), ch-ip-lookup=()');
  

• Middleware Stacking: Combine with other Spatie middleware (e.g., spatie/laravel-activitylog) for layered privacy controls.

Gotchas and Tips

Pitfalls

1. Header Conflicts:

   • If another package modifies Permissions-Policy, ensure interest-cohort=() isn’t overridden. Use DisableFloc::addToHeader() to append safely.

2. Caching Headers:

   • FLoC headers may be cached by proxies/CDNs. Test with Cache-Control: no-cache to verify real-time changes.

3. Laravel Version:

   • Requires Laravel 5.5+. For older versions, manually register the middleware in app/Http/Kernel.php:

     protected $middleware = [
         // ...
         \Spatie\DisableFloc\Middleware\DisableFloc::class,
     ];
     

Debugging

• Verify Headers: Use dd($request->headers->get('Permissions-Policy')) in a middleware to inspect the header.

• Disable for Testing: Temporarily disable the package in config/floc.php:

  'enabled' => env('DISABLE_FLOC_TESTING', false),
  

Extension Points

1. Custom Logic: Override the default header logic by publishing the config:

   php artisan vendor:publish --provider="Spatie\DisableFloc\DisableFlocServiceProvider"
   

   Then modify config/floc.php to include custom conditions.

2. Event-Based Control: Listen for floc.disabled events to react to FLoC changes:

   event(new FLoCDisabled($request));
   

3. Conditional Middleware: Dynamically enable/disable via a service:

   app(DisableFloc::class)->disable(); // Disable for current request
   app(DisableFloc::class)->enable();  // Re-enable