#Laravel + Livewire Starter Kit: Docker-verified fork

We took the official laravel/livewire-starter-kit (Livewire v4 + Flux + Alpine), ran it inside Docker, and published a production-hardened fork. Tests go from the upstream 33 passed to 37 passed / 92 assertions. This article covers the Livewire-specific findings — of the three starter kits, Livewire has the largest non-backend delta.

The 6 shared backend improvements are consolidated in the pillar:

→ Hardening the shared Laravel starter-kit backend

#Target

#Upstream verification result

docker compose run --rm app returns 33 passed (77 assertions). Fewer tests than the React / Vue kits' 40 — this variant exercises form behavior through Livewire's component test harness rather than the Inertia HTTP harness, so the assertion distribution differs. Coverage is not weaker.

#Four ways Livewire is structurally different

The Laravel backend is shared across all three kits, but the Livewire variant differs in ways that change the finding set.

These four produce the Livewire-specific differences below.

#The Wayfinder footgun doesn't happen

The "npm run build before composer install fails opaquely" problem that hits React / Vue does not occur in the Livewire kit. Its vite.config.js (React/Vue use .ts) has no @laravel/vite-plugin-wayfinder, so the build never shells out to artisan and has no dependency on vendor/autoload.php.

The official README lacking a Setup section is a minor gap shared by all three kits, so the fork adds one for contributors — but without the React/Vue-specific "looks like a Wayfinder bug" trap.

#Security-header middleware — a worse starting state than React/Vue

Pillar finding D (security headers) is shared across all three, but Livewire's starting state is the worst. The withMiddleware() callback in bootstrap/app.php has a body of just a // comment — zero appended web middleware. React / Vue at least had the three Inertia-related ones; Livewire has none.

The fork's SetSecurityHeaders middleware becomes the first web middleware appended in this fork.

#CSP — Livewire can go nonce-based

This is Livewire's biggest specific. The Inertia kits (React/Vue) embed initial state in an inline <script>, so dropping 'unsafe-inline' from the CSP requires patching Inertia.

Livewire does not embed initial state in an inline script. The client JS loads via external <script src>, component state lives in wire:* attributes on HTML elements, and updates go through a fetch to /livewire/update. So it can move to a strict nonce-based CSP without 'unsafe-inline'.

This hardening article keeps the CSP policy aligned with React/Vue (conservatively keeping 'unsafe-inline'), but Livewire can go further. The nonce migration is its own follow-up article:

→ Laravel + Livewire Starter Kit: nonce-based CSP

#J. Settings rate limiting — deferred because the shape differs

In React / Vue, throttling profile update/destroy was just adding throttle middleware to the PATCH/DELETE routes in routes/settings.php.

Livewire is different. routes/settings.php uses Route::livewire('settings/profile', ...) to render component pages, and profile updates and password changes flow through Livewire's internal AJAX endpoint (/livewire/update). A route-level throttle only covers the initial page load, not component actions.

The correct fix is per-component RateLimiter::tooManyAttempts inside the action methods — a substantively different commit from React/Vue. It's deferred this pass for a Livewire-specific follow-up.

#Commit layout — 7 commits

React/Vue have 8 commits, Livewire has 7. The difference is finding J — deferred here because the fix shape differs.

Tests: upstream 33 passed → improved 37 passed / 92 assertions.

#Before / after (Livewire-specific part)

The before/after for the 6 shared backend findings is in the pillar.

#When this fits

• You're starting a production product on laravel/livewire-starter-kit.
• You want PHP / Blade all the way down.
• You want a strict CSP — Livewire can drop 'unsafe-inline' via the nonce migration (an edge over the Inertia kits).

#Reproduce and adopt

git clone https://github.com/codelift-dev/livewire-starter-kit.git
cd livewire-starter-kit
git checkout improvements
docker compose -f codelift/docker-compose.yml build
docker compose -f codelift/docker-compose.yml run --rm app

Application diff only: git diff main improvements -- . ':!codelift'

#Related

• Pillar: Hardening the shared Laravel starter-kit backend
• Follow-up: Livewire Starter Kit: nonce-based CSP
• Sister clusters: React / Vue
• Comparison: React vs Vue vs Livewire

#License

Upstream and improved fork both MIT. Findings reflect the verification date.