vitamin2 / juicebox

v0.3.0 2026-10-15 13:34 UTC

Requires

• php: ^8.5
• statamic/cms: ^6.0

Requires (Dev)

• driftingly/rector-laravel: ^2.6
• larastan/larastan: ^3.0
• laravel/pao: ^1.1
• laravel/pint: ^1.29
• orchestra/testbench: ^11.0
• pestphp/pest: ^5.0
• pestphp/pest-plugin-arch: ^5.0
• pestphp/pest-plugin-laravel: ^5.0
• pestphp/pest-plugin-phpstan: ^5.2
• pestphp/pest-plugin-rector: ^5.0
• pestphp/pest-plugin-type-coverage: ^5.0
• phpstan/extension-installer: ^1.4.3
• phpunit/phpunit: ^13.0
• rector/rector: ^2.6
• spatie/laravel-ray: ^1.43

MIT

• VITAMIN 2

Published on Packagist.org on 2026-10-15 13:37 UTC

README

This is the core Statamic addon used by VITAMIN 2.

How to Install

You can install this addon via Composer:

composer require vitamin2/juicebox

Features

Secure Headers Middleware

Vitamin2\Juicebox\Features\SecureHeaders\Http\Middleware\SetSecureHeaders

Appends security-related HTTP response headers to every request. Registered automatically via the service provider.

Header	Default value	Purpose
Strict-Transport-Security	max-age=31536000	Force HTTPS for 1 year. Only set on secure (HTTPS) requests.
X-Frame-Options	SAMEORIGIN	Prevent clickjacking by controlling iframe embedding.
X-Content-Type-Options	nosniff	Stop browsers from MIME-sniffing responses away from the declared content type.
Referrer-Policy	strict-origin-when-cross-origin	Limit referrer info sent with cross-origin requests.

Configuration

Publish the config file:

php artisan vendor:publish --tag=statamic-juicebox-secure-headers-config

Key	Default	Accepted values
enabled	true	true, false
strict_transport_security	'max-age=31536000'	Valid HSTS directive string, false
x_frame_options	'SAMEORIGIN'	'DENY', 'SAMEORIGIN', false
x_content_type_options	'nosniff'	'nosniff', false
referrer_policy	'strict-origin-when-cross-origin'	Any valid policy string, false

Set any value to false to omit that header entirely.

Environment variables

Variable	Default	Description
JUICEBOX_SECURE_HEADERS_ENABLED	true	Master toggle — disables all headers when false.

Development

composer test            # full gate: analyse + lint:check + refactor:check + test:types + test:unit
composer test:unit       # pest (parallel)
composer test:types      # pest --type-coverage --min=100
composer test:coverage   # pest --coverage --min=100 (needs Xdebug)
composer analyse         # phpstan
composer lint:check      # pint --test
composer refactor:check  # rector --dry-run

lint and refactor (without :check) apply fixes instead of just checking.

See docs/adding-a-feature.md for how to add a feature.

Workbench

A minimal Statamic 6 site (Orchestra Workbench) for trying the addon in a browser:

composer serve   # builds the workbench and starts it on http://127.0.0.1:8000

The control panel is at /cp. A seeded super user is available for local use: [e-mail] / password (workbench/users/).