Skip to content

Security

Laravel Livewire Documentation Reference

Since Magewire is heavily inspired by Laravel Livewire, many concepts are either identical or very similar. To avoid duplicating documentation, this page only covers Magewire-specific and platform-specific details. For all general concepts and in-depth explanations, you can refer to the corresponding Laravel Livewire documentation.

Livewire Reference

CSRF

Magento's FormKey protects every Magewire request automatically. The browser sends it as the top-level _token field in the POST request envelope. The router exposes it to the form-key validator as token and removes it from the component payload; it is not stored inside the serialized snapshot. Magewire rejects requests with a missing or stale key. Do not disable FormKey on the Magewire route.

Snapshot checksum

Each snapshot carries an HMAC checksum signed with the Magento crypt key (app/etc/env.php → crypt/key). The checksum authenticates the snapshot's integrity; it does not authorise the user. Always check permissions inside actions.

Public properties are browser-controlled state. Magewire 3.6 does not provide a documented locked-property attribute, so do not rely on an identifier being absent from the template or lacking wire:model. Reload sensitive entities in the action, validate the current user against the exact target, and keep authorization in the service that performs the write.

Namespace and escaping

Components extend Magewirephp\Magewire\Component. In templates the instance is available as $magewire; use Magento's $escaper for every output:

<p><?= $escaper->escapeHtml($magewire->bio) ?></p>
<a href="<?= $escaper->escapeUrl($magewire->link) ?>">…</a>
<img alt="<?= $escaper->escapeHtmlAttr($magewire->caption) ?>" src="…" />
<script>var name = <?= $escaper->escapeJs(json_encode($magewire->name)) ?>;</script>

Authorisation

Use Magento's authorization service in public methods, and boot() for up-front guards:

public function refund(int $orderId): void
{
    if (! $this->authorization->isAllowed('Magento_Sales::refund')) {
        throw new \Magento\Framework\Exception\AuthorizationException(__('Not allowed.'));
    }

    $this->refundService->refund($orderId);
}

public function boot(): void
{
    if (! $this->customerSession->isLoggedIn()) {
        throw new \Magento\Framework\Exception\AuthorizationException(__('Login required.'));
    }
}

Rate limiting

Magewire ships SupportMagewireRateLimiting, disabled by default. Enable the appropriate request or component variant per scope after choosing a budget suitable for the application. See Rate Limiting.

Use Request Filters for inexpensive request-wide checks that must run before component reconstruction. Filters complement, not replace, authorization inside actions.

Vulnerability reports

Report suspected Magewire vulnerabilities privately to magewirephp@wpoortman.nl according to the repository security policy. Do not post exploit details in a public issue, discussion, or pull request.

CSP

Magewire's bundle ships the CSP build of Alpine. Inline scripts go through the fragment system; never emit a raw <script> tag from a component template.