Proxy with Laravel

A small route file relays the script and events with Laravel's HTTP client.

Set it up

1. Create routes/metricraven.php

   routes/metricraven.php

   Copy

   1

   2

   3

   4

   5

   6

   7

   8

   9

   10

   11

   12

   13

   14

   15

   16

   17

   18

   19

   20

   21

   22

   23

   24

   25

   26

   <?php
   // routes/metricraven.php
   use Illuminate\Http\Request;
   use Illuminate\Support\Facades\Http;
   use Illuminate\Support\Facades\Route;
   
   Route::match(['get', 'post'], '/a/{kind}', function (Request $request, string $kind) {
       $script = $kind === 'script' && $request->isMethod('get');
       $event = $kind === 'event' && $request->isMethod('post');
       abort_unless($script || $event, 404);
   
       $client = Http::timeout(15)->withHeaders(array_filter([
           'Origin' => $request->header('Origin'),
           'User-Agent' => $request->userAgent(),
           'X-Visitor-IP' => $request->ip(),
       ]));
       $upstream = $script
           ? $client->get('https://metricraven.com/js/script.js')
           : $client
               ->withBody($request->getContent(), $request->header('Content-Type', 'text/plain'))
               ->post('https://metricraven.com/api/v1/collect');
   
       return response($upstream->body(), $upstream->status())
           ->header('Content-Type', $upstream->header('Content-Type') ?: 'application/octet-stream')
           ->header('Cache-Control', $script ? 'public, max-age=3600' : 'no-store');
   })->whereIn('kind', ['script', 'event']);

2. Load it outside the web middleware group

   In bootstrap/app.php, add the then callback to your existing withRouting call. The routes then skip sessions and CSRF checks, which the tracker can't send.

   bootstrap/app.php

   Copy

   1

   2

   3

   4

   5

   6

   7

   8

   9

   10

   11

   12

   13

   14

   15

   16

   17

   18

   // bootstrap/app.php · Laravel 11 or later
   use Illuminate\Support\Facades\Route;
   
   return Application::configure(basePath: dirname(__DIR__))
       ->withRouting(
           web: __DIR__.'/../routes/web.php',
           commands: __DIR__.'/../routes/console.php',
           health: '/up',
           // Outside the "web" group: no session cookie and no CSRF check on the tracker routes.
           then: function () {
               Route::group([], base_path('routes/metricraven.php'));
           },
       )
       ->withMiddleware(function (Middleware $middleware) {
           // Behind a load balancer or CDN? Trust it so $request->ip() is the visitor.
           // $middleware->trustProxies(at: '*');
       })
       // ...the rest of your existing configuration

3. Add the script tag to your Blade layout

   Paste it before </head> in the layout every page extends, for example resources/views/layouts/app.blade.php.

4. Point your script tag at your own paths

   Replace your MetricRaven tag with this one. src loads the tracker from your domain and data-api sends its events there too.

   Your website's shared layout

   Copy

   1

   <script defer src="/a/script" data-api="/a/event" data-site-id="YOUR_SITE_ID"></script>

Notes

• If a CDN or load balancer sits in front of this server, the connecting address is that proxy, not the visitor. Use the visitor IP header it sets (and only one it overwrites, so visitors can't fake it).
• In Laravel, trust your load balancer with $middleware->trustProxies() so $request->ip() is the visitor.
• On Laravel 10 or earlier, register the file in RouteServiceProvider without the web middleware instead.

How the proxy works and which headers it must send: Use your own domain.