Livewire Strict

Livewire Strict is a Laravel package that fixes two security gaps in Livewire.

Security Issues

Out of the box, users can:

• Change any public property from the browser console.
• Edit the arguments of a wire:click call in DevTools before clicking.

Lock Public Properties

Livewire's #[Locked] attribute prevents the first issue, but only for properties you remember to annotate.

Livewire Strict solves this with a single line in a service provider that locks every public property in your Livewire components.

To allow a property to change again, mark it with #[Unlocked].

Secure Actions

For actions, mark the method with #[Signed] and render the call using @livewireAction.

Each call carries an HMAC signature, allowing the server to reject:

• Calls with edited arguments.
• Calls made directly from JavaScript.

This helps ensure that action arguments cannot be tampered with in the browser.