Security

The preview runs your application's code to render messages, so it is meant for your own machine. These are the limits it applies to who can reach it and to the requests it sends.

Local environment only

The preview's routes answer only when APP_ENV is local. In every other environment they return 404, so deploying the package does not expose the preview.

Allowed hosts

In the local environment, the preview answers requests to:

• The host in APP_URL and its subdomains.
• localhost and .localhost domains.
• .test domains.
• IP addresses.

Requests to any other host return 403, so another site cannot reach the preview by pointing its own domain at your machine. Because IP addresses are allowed, anyone who can reach your development server over the network can open the preview. Keep the server bound to 127.0.0.1, the default for php artisan serve, unless you mean to share it.

Middleware

The preview needs no session or authentication, so its routes skip the web middleware group. Middleware listed in the middleware option of the configuration runs on every preview route, before the environment and host checks.

Requests from other sites

Checking links and sending a test email are POST requests, and the preview rejects them when the browser reports that they come from another site. A page on another site cannot make your browser send a test email or start a link check.

Open in a browser tab serves the HTML body with a Content Security Policy that blocks scripts and form submissions, so a message cannot run code on the preview's origin.

What the link check requests

The Links check requests the absolute HTTP and HTTPS URLs in a message's links and images, with these exceptions:

• URLs on the APP_URL host, the host the preview is open on, localhost, 127.* and [::1] addresses, and .test and .localhost domains are never requested. The check matches them against the application's GET routes and the files in public without running a route's middleware or controller, so it never uses a signed verification, password-reset, or unsubscribe link.
• URLs whose host is or resolves to a private, loopback, link-local, or reserved address are not requested and show as Skipped. This applies to redirect targets too.

Every other URL gets a HEAD request. When the server answers 405 or 501, the check sends a GET and stops reading once the headers arrive. It follows up to five redirects and gives each request five seconds. It sends no cookies, ignores proxy settings, and connects to the address it checked, so a DNS change between the check and the request cannot send it to a private address. At most four URLs are requested at a time, and at most two per host.