Laravel

Before you start

A firewall integration enforces the signed policy bundle of your site in front of your origin: block, redirect, challenge and token-gated routes. It fetches the bundle from GET /v1/policies/<site key>, verifies its signature offline and decides every request the same way in every language. It does not replace verifying tokens in your own code. A request that reaches your origin another way (a direct IP, another hostname, a path the integration was not installed on) is never evaluated, so let only the integration reach the origin. See firewall policies.

The secret key (rgsk_...) is needed only for requireToken rules. Without it such a rule applies its onError setting.

Install and mount

Composer package revokegpt/firewall-laravel (PHP 8.2 or later; needs ext-sodium, ext-curl, ext-mbstring and ext-json). The service provider is auto-discovered and prepends the middleware to the global stack, so it runs before routing and before every other middleware.

Publish the config with php artisan vendor:publish --tag=revokegpt-config. Settings include site_key, secret_key, api_base, initial_fail_mode (open by default, or closed) and cache_store. PHP serves each request in a fresh process, so the bundle cache is the Laravel cache store; the signature and site binding are checked again every time the cached bundle is read.

RG_SITE_KEY=rgpk_...
RG_SECRET_KEY=rgsk_...        # needed for requireToken rules
RG_SIG_SECRET=                # optional: 16+ characters, turns on the signed X-RG-Sig header when the policy asks for it

Keep routing case-sensitive

Firewall rules match paths case-sensitively, so /ADMIN is not /admin. If your origin routes case-insensitively (IIS, a case-folding proxy or framework), /ADMIN can reach the /admin handler while a rule on /admin never sees it. Make the origin case-sensitive, or write a rule for each spelling it serves.