for.duty collects your sites' browser reports — CSP violations, network errors, deprecations — groups them into distinct problems, and alerts your team only when something new appears.

Installation

You can install the package via Composer:

composer require concept7/laravel-forduty

You may publish all of the package's resources at once:

php artisan vendor:publish --tag="laravel-forduty"

Or, you may publish each resource individually:

Publishing the Configuration File

php artisan vendor:publish --tag="laravel-forduty-config"

Usage

Add your for.duty site token to your .env file:

FORDUTY_TOKEN=your-site-token

That's it. The package automatically appends its middleware to the web middleware group, so responses from routes in that group carry a Reporting-Endpoints header pointing browsers at your for.duty endpoint:

Reporting-Endpoints: default="https://in.forduty.app/your-site-token"

Because the header comes from group middleware, it covers the web group only. Requests that never match a route — 404s, for example — and routes in other groups such as api are served without it. See below for attaching the middleware elsewhere.

The middleware adds no header when the token is missing or blank, or when the base URL is blank, unparseable, not an absolute http or https URL, or carries credentials. That keeps a misconfiguration from breaking responses, and makes local and development environments quiet by default. The reporting URL defaults to https://in.forduty.app and can be overridden with FORDUTY_BASE_URL.

The middleware overwrites any existing Reporting-Endpoints header. To disable it for specific routes, use withoutMiddleware():

use Concept7\LaravelForduty\Http\Middleware\AddReportingEndpointsHeader;

Route::get('/embed', EmbedController::class)
    ->withoutMiddleware(AddReportingEndpointsHeader::class);

Opting Report Types In

Reporting-Endpoints only names the endpoints a browser is allowed to deliver reports to. Which reports actually get sent depends on the report type:

• Deprecations, interventions and crashes are delivered to the default endpoint on their own. The header above is all they need.

• CSP violations are only reported once your Content-Security-Policy header points at the endpoint with a report-to directive:

  Content-Security-Policy: default-src 'self'; report-to default
  

• Network errors require an additional NEL header.

This package sets Reporting-Endpoints and nothing else, so it does not turn CSP or network error reporting on by itself. If you build your policy with a package such as spatie/laravel-csp, add the report-to default directive to it.

Other Middleware Groups

To attach it to other middleware groups such as api, append it in bootstrap/app.php:

use Concept7\LaravelForduty\Http\Middleware\AddReportingEndpointsHeader;

->withMiddleware(function (Middleware $middleware): void {
    $middleware->api(append: AddReportingEndpointsHeader::class);
})

Changelog

Please see CHANGELOG for more information on what has changed recently.

Contributing

Thank you for considering contributing to Laravel Forduty! Please review our contributing guide to get started.

Security Vulnerabilities

Please review our security policy on how to report security vulnerabilities.

Credits

• Jan Henk Hazelaar
• All Contributors

License

Laravel Forduty is open-sourced software licensed under the MIT license.