PHPackages katalam/laravel-cookieless-session - PHPackages - PHPackages [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register) 1. [Directory](/) 2. / 3. [Authentication & Authorization](/categories/authentication) 4. / 5. katalam/laravel-cookieless-session ActiveLibrary[Authentication & Authorization](/categories/authentication) katalam/laravel-cookieless-session ================================== This is my package laravel-cookieless-session 1.3.3(1y ago)114MITPHPPHP ^8.3CI passing Since Dec 22Pushed 1y ago1 watchersCompare [ Source](https://github.com/Katalam/laravel-cookieless-session)[ Packagist](https://packagist.org/packages/katalam/laravel-cookieless-session)[ Docs](https://github.com/katalam/laravel-cookieless-session)[ GitHub Sponsors]()[ RSS](/packages/katalam-laravel-cookieless-session/feed)WikiDiscussions main Synced 1mo ago READMEChangelog (9)Dependencies (12)Versions (10)Used By (0) This is my package laravel-cookieless-session ============================================= [](#this-is-my-package-laravel-cookieless-session) [![Latest Version on Packagist](https://camo.githubusercontent.com/6ed027597a95351be149d4ff3a5bcdb060ea0c51914b9050b5b1310b462d39a6/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f762f6b6174616c616d2f6c61726176656c2d636f6f6b69656c6573732d73657373696f6e2e7376673f7374796c653d666c61742d737175617265)](https://packagist.org/packages/katalam/laravel-cookieless-session)[![GitHub Tests Action Status](https://camo.githubusercontent.com/8700a55b0f9599853dfc978c409531f4bdb1cb5d28675e5db6f67ac63094cd69/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f616374696f6e732f776f726b666c6f772f7374617475732f6b6174616c616d2f6c61726176656c2d636f6f6b69656c6573732d73657373696f6e2f72756e2d74657374732e796d6c3f6272616e63683d6d61696e266c6162656c3d7465737473267374796c653d666c61742d737175617265)](https://github.com/katalam/laravel-cookieless-session/actions?query=workflow%3Arun-tests+branch%3Amain)[![GitHub Code Style Action Status](https://camo.githubusercontent.com/ec02509c42d8e7d6bc3c5638660343a51a9e1803152bf414f1a5e61d3cc75e37/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f616374696f6e732f776f726b666c6f772f7374617475732f6b6174616c616d2f6c61726176656c2d636f6f6b69656c6573732d73657373696f6e2f6669782d7068702d636f64652d7374796c652d6973737565732e796d6c3f6272616e63683d6d61696e266c6162656c3d636f64652532307374796c65267374796c653d666c61742d737175617265)](https://github.com/katalam/laravel-cookieless-session/actions?query=workflow%3A%22Fix+PHP+code+style+issues%22+branch%3Amain)[![Total Downloads](https://camo.githubusercontent.com/13d413993fef2b9d4b9830bed092b463cd74847bf2c8f84ee753ab2e0ead31a3/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f64742f6b6174616c616d2f6c61726176656c2d636f6f6b69656c6573732d73657373696f6e2e7376673f7374796c653d666c61742d737175617265)](https://packagist.org/packages/katalam/laravel-cookieless-session) Installation ------------ [](#installation) You can install the package via composer: ``` composer require katalam/laravel-cookieless-session ``` You can publish the config file with: ``` php artisan vendor:publish --tag="cookieless-session-config" ``` This is the contents of the published config file: ``` return [ 'header' => [ 'name' => 'X-Session-Token', // The name of the header to be used 'include_with_response' => true, // Whether to include the session token in the response header ], 'parameter' => [ 'name' => '_session_token', // The name of the parameter to be used, either in the query string or in the request body ], ]; ``` Usage ----- [](#usage) Inside `bootstrap/app.php` replace the `StartSession` middleware with the one provided by this package. ``` use Katalam\Cookieless\Http\Middleware\StartSession; use Illuminate\Session\Middleware\StartSession as DefaultStartSession; $middleware->web(replace: [ DefaultStartSession::class => StartSession::class, ]); ``` or use the middleware directly in your routes ``` use Katalam\Cookieless\Http\Middleware\StartSession; Route::get('/profile', function () { // ... })->middleware(StartSession::class); ``` Documentation ------------- [](#documentation) The package aims to provide a way to have a website without the ability to dispatch cookies and have a session at the same time. This is useful for websites that need to be GDPR-compliant and do not want to store any cookies on the user's device. The technical implementation is based on the following principles: We have a (new) Middleware named `StartSession` that is responsible for starting the session. We overwrite the default `StartSession` Middleware provided by Laravel at two points: - We check the presence of cookies in the request and start the session normally if they are present. - We also check the presence of a header or a parameter in the request. If they are present, we start the session with the (encrypted) session id provided in the header or parameter. - We also do not send the session cookie in the response if the session was started with a header or parameter. Now we need to understand two things: - How is the session data stored? - How is a user authenticated? The session data is with various drivers stored in a persistent storage connected to the webserver. The session is identified by a unique string. We encrypt this string and send it to the client in some way. The client sends this string back to the server in the request. We decrypt this string and use it to identify the session. This is secure because the string is encrypted the same way as the session id in the cookie. The user is authenticated by the session. We pass the request inside the `SessionGuard.php` where we check if the session has a user id inside the payload attribute. To determine the key inside the payload for the user id, we have a combination of the word login, the name of the auth guard and a hash of the absolute namespace from the auth guard. This is to ensure that the key is unique for each auth guard. What we essentially do is to replace the session cookie with a header or parameter. The rest of the internal handling of the session is the same as with the session cookie. Testing ------- [](#testing) ``` composer test ``` Contributing ------------ [](#contributing) Please see [CONTRIBUTING](CONTRIBUTING.md) for details. Security Vulnerabilities ------------------------ [](#security-vulnerabilities) Please review [our security policy](../../security/policy) on how to report security vulnerabilities. Credits ------- [](#credits) - [Bruno Görß](https://github.com/Katalam) - [All Contributors](../../contributors) License ------- [](#license) The MIT License (MIT). Please see [License File](LICENSE.md) for more information. ### Health Score 32 — LowBetter than 72% of packages Maintenance45 Moderate activity, may be stable Popularity7 Limited adoption so far Community7 Small or concentrated contributor base Maturity59 Maturing project, gaining track record Bus Factor1 Top contributor holds 100% of commits — single point of failure How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window. **Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores. **Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement. **Maturity (30%)** — Project age, version count, PHP version support, and release stability. ### Release Activity Cadence Every ~10 days Recently: every ~19 days Total 9 Last Release 429d ago ### Community Maintainers ![](https://www.gravatar.com/avatar/7288d004ea85212d570ae07879b258446f6e66050f0d73de1e8a29c3c4dc785c?d=identicon)[Katalam](/maintainers/Katalam) --- Top Contributors [![Katalam](https://avatars.githubusercontent.com/u/39590058?v=4)](https://github.com/Katalam "Katalam (23 commits)") --- Tags laravelBruno Görßlaravel-cookieless-session ### Code Quality TestsPest Static AnalysisPHPStan Code StyleLaravel Pint ### Embed Badge ![Health badge](/badges/katalam-laravel-cookieless-session/health.svg) ``` [![Health](https://phpackages.com/badges/katalam-laravel-cookieless-session/health.svg)](https://phpackages.com/packages/katalam-laravel-cookieless-session) ``` ### Alternatives [spatie/laravel-permission Permission handling for Laravel 12 and up 12.9k89.8M1.0k](/packages/spatie-laravel-permission)[bezhansalleh/filament-shield Filament support for `spatie/laravel-permission`. 2.8k2.9M88](/packages/bezhansalleh-filament-shield)[jeffgreco13/filament-breezy A custom package for Filament with login flow, profile and teams support. 1.0k1.7M41](/packages/jeffgreco13-filament-breezy)[spatie/laravel-login-link Quickly login to your local environment 4381.2M1](/packages/spatie-laravel-login-link)[ryangjchandler/laravel-cloudflare-turnstile A simple package to help integrate Cloudflare Turnstile. 438896.6k2](/packages/ryangjchandler-laravel-cloudflare-turnstile)[spatie/laravel-passkeys Use passkeys in your Laravel app 444494.4k16](/packages/spatie-laravel-passkeys) PHPackages © 2026 [Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)