jeffersongoncalves/laravel-favicon-proxy

A Laravel package that proxies and server-side caches website favicons (Google S2 by default) behind a same-origin route, so visitors' browsers never hit the third-party favicon service. Validates the upstream content-type, sends nosniff, negative-caches failures and falls back to a transparent pixe

v1.0.0 2026-06-22 00:13 UTC

Requires

• php: ^8.2
• guzzlehttp/guzzle: ^7.8
• illuminate/contracts: ^11.0|^12.0|^13.0
• illuminate/http: ^11.0|^12.0|^13.0
• illuminate/routing: ^11.0|^12.0|^13.0
• illuminate/support: ^11.0|^12.0|^13.0
• spatie/laravel-package-tools: ^1.14

Requires (Dev)

• larastan/larastan: ^3.0
• laravel/pint: ^1.0
• orchestra/testbench: ^9.0|^10.0|^11.0
• pestphp/pest: ^3.7.4|^4.0
• pestphp/pest-plugin-laravel: ^3.0|^4.0

MIT

• Jefferson Gonçalves

• laravel
• jeffersongoncalves
• laravel-favicon-proxy

README

Laravel Favicon Proxy

Proxy website favicons through your own host. Instead of pointing an external-link <img> straight at a third-party favicon service (a cross-origin connection on every page, leaking which links a visitor sees), this fetches the icon server-side once, caches the bytes, and serves them same-origin — the browser never talks to the upstream.

• Default upstream is Google's S2 favicon service; configurable.
• Validates the upstream content-type and sends X-Content-Type-Options: nosniff (a non-image response is never served under an image type).
• Negative-caches failures, falls back to a transparent 1×1 pixel.

Installation

composer require jeffersongoncalves/laravel-favicon-proxy

The /favicon-proxy route is registered automatically. Point your icons at it:

<img src="{{ route('favicon-proxy', ['domain' => 'laravel.com']) }}" alt="" width="16" height="16">

Optionally publish the config:

php artisan vendor:publish --tag="favicon-proxy-config"

Configuration

Key	Default	Description
enabled	true	Register the proxy route.
path	favicon-proxy	Route path.
middleware	['throttle:120,1']	Middleware on the route.
endpoint	https://www.google.com/s2/favicons	Upstream favicon service.
query	domain	Query parameter carrying the domain.
size	64	Requested icon size (px).
timeout	6	Upstream request timeout (s).
cache_prefix	favicon	Cache key prefix.
cache_days	30	How long a fetched icon is cached.
negative_cache_hours	6	How long a failure is negative-cached.

Testing

composer test

License

The MIT License (MIT). Please see License File for more information.