Weave Code
Untrust Laravel Package
unisharp/untrust
UniSharp Untrust is a lightweight Laravel/PHP package for handling untrusted data. It helps mark user-controlled or external input as untrusted, giving you a clear boundary for safely filtering and processing it in your application. Simple to install and integrate.
Un-Trust is an "Un"iSharp implementation of the entrust package
Frequently asked questions about Untrust
- What is UniSharp Untrust used for in Laravel?
- UniSharp Untrust is a Laravel package that disables TLS/SSL certificate verification for Laravel's HTTP client. It is useful when your app calls local or internal services that use self-signed certificates. Instead of adding verify => false to every Guzzle request, you can apply the opt-out through the package. It is intended for development and trusted network environments.
- How do I install unisharp/untrust in a Laravel application?
- Install it with Composer using composer require unisharp/untrust. The package supports Laravel package auto-discovery, so you normally do not need to register its service provider manually. Check the repository README for any package-specific configuration or publishing steps.
- Does Untrust work with Laravel's HTTP client and Http facade?
- Yes, Untrust is designed to integrate with Laravel's HTTP client, which uses Guzzle underneath. It disables certificate verification for outgoing HTTP requests made through that client. This means calls made with Laravel's Http facade can reach self-signed local or internal HTTPS services without repeating Guzzle's verify option.
- How is Untrust different from adding verify => false to every Guzzle request?
- Adding verify => false per request requires repeating the option everywhere, which is easy to forget. Untrust provides a package-level way to globally disable SSL verification for Laravel's HTTP client. The tradeoff is that the behavior is broader, so it should only be enabled in controlled environments.
- Is it safe to use Untrust in production?
- Generally, no. Disabling TLS/SSL certificate verification removes protection against man-in-the-middle attacks and should not be used for normal production traffic. It is intended for development, staging, local services, or trusted internal networks. For production, prefer properly trusted certificates or configure a CA bundle instead.
- Which Laravel versions does unisharp/untrust support?
- The package is built for Laravel's HTTP client and uses package auto-discovery, but the provided overview does not list exact Laravel version constraints. You should check the repository's composer.json and README for supported Laravel and PHP versions. Confirm compatibility before adding it to an existing application.
- Can I disable SSL verification only for specific hosts or requests?
- The package is described as globally disabling SSL verification for outgoing requests through Laravel's HTTP client. If you need per-host or per-request control, use Guzzle request options such as verify => false or a custom HTTP client configuration instead. That keeps the exception limited to the specific internal service.
- Do I need to publish a config file or register a service provider manually?
- Because the package supports Laravel package auto-discovery, manual service provider registration is usually unnecessary. If the package includes publishable configuration, the README should describe the artisan vendor:publish command to use. Otherwise, installation and auto-discovery are typically enough.
- Does Untrust affect cURL, Guzzle, or other HTTP clients outside Laravel?
- Untrust integrates with Laravel's HTTP client, which is powered by Guzzle. It does not change raw cURL usage or HTTP clients in other frameworks or standalone PHP scripts. If you make requests outside Laravel's HTTP client, you must configure certificate verification separately.
- What are alternatives to disabling SSL verification for self-signed certificates?
- A safer alternative is to add the internal CA or self-signed certificate to your system or application trust store. With Guzzle, you can also point the verify option to a CA bundle path instead of setting it to false. Using properly issued certificates is best for production, while Untrust is a convenience for development and trusted networks.
Weaver
How can I help you explore Laravel packages today?