Repository navigation
Tamper-proof actions #2
Description
You've asked for more ideas to make Livewire strict. So here we go...
Another issue (which most devs do not expect) is that also the action call in the HTML can be changed. So that id that should be passed? Yeah, that can be changed on the client side too.
It would be great to have an option (like signed urls) to make action calls tamper proof. An idea would be that the action with parameters and component instance id are signed to disable any modifcations.
class UserBalance extends Component
{
#[Signed]
public function updateBalance(int $sum)
{
// ....
}
}
LivewireStrict::signedActions();<button wire:click="@livewireAction('delete', $post->id)" />
Activity
[-]Tamper-proof action[/-][+]Tamper-proof actions[/+]virtualtear commentedon Feb 13, 2026
Hey @tpetry ! I just opened up a PR for this feature here #3.
I do not know if the package is still maintained since it's been around 2 years since the last commit. If this is still relevant for you I would also be glad to register my fork of the package for it to be able to be used. But first let's wait if @PhiloNL is still active and wants to continue working on this package. I really do love the package and would be more than glad to be able to help with future requets :)
PhiloNL commentedon Feb 13, 2026
Hey @h4or
Thanks for the PR, happy to merge it 😄
virtualtear commentedon Feb 13, 2026
Oh! That was quick 😄 Glad to see the package is doing well !
PhiloNL commentedon Mar 12, 2026
Closing this, thanks for the feature @h4or 😄