Accept text/plain events from the Plausible tracker
dependabot-auto-merge / dependabot (pull_request_target) Skipped
Fix PHP code style issues / php-code-styling (push) Successful in 6s
PHPStan / phpstan (push) Successful in 2m38s
run-tests / P8.3 - L11.* - prefer-lowest - ubuntu-latest (push) Failing after 33s
run-tests / P8.4 - L11.* - prefer-lowest - ubuntu-latest (push) Canceled after 0s
run-tests / P8.4 - L11.* - prefer-stable - ubuntu-latest (push) Canceled after 0s
run-tests / P8.3 - L12.* - prefer-lowest - ubuntu-latest (push) Canceled after 0s
run-tests / P8.3 - L12.* - prefer-stable - ubuntu-latest (push) Canceled after 0s
run-tests / P8.4 - L12.* - prefer-lowest - ubuntu-latest (push) Canceled after 0s
run-tests / P8.4 - L12.* - prefer-stable - ubuntu-latest (push) Canceled after 0s
run-tests / P8.3 - L13.* - prefer-lowest - ubuntu-latest (push) Canceled after 0s
run-tests / P8.3 - L13.* - prefer-stable - ubuntu-latest (push) Canceled after 0s
run-tests / P8.4 - L13.* - prefer-lowest - ubuntu-latest (push) Canceled after 0s
run-tests / P8.4 - L13.* - prefer-stable - ubuntu-latest (push) Canceled after 0s
run-tests / P8.3 - L11.* - prefer-stable - ubuntu-latest (push) Canceled after 1s

The Plausible tracker posts its JSON payload with Content-Type text/plain,
  which Laravel does not parse, so every real event failed validation and
  was redirected instead of being forwarded.

  - Decode the raw body when the request is not JSON
  - Respond with 400 instead of a redirect on invalid non-JSON requests
  - Trim trailing slash from the configured domain when forwarding events
  - Add a 5s timeout and respond with 502 when Plausible is unreachable
This commit is contained in:
mathiaspalmqvist committed 2026-11-12 09:18:50 +01:00
1 parent c1338fad8b
commit a97baf5921
3 files changed
+98 -4

No files matched your search

+54
View File
@@ -1,5 +1,6 @@
<?php
use Illuminate\Http\Client\ConnectionException;
use Illuminate\Support\Facades\Http;
it('fetches plausible script and caches it', function () {
@@ -145,3 +146,56 @@ it('rejects invalid props', function () {
'p' => 'not-json',
])->assertStatus(422)->assertJsonValidationErrors(['p']);
});
it('accepts events sent as text/plain by the plausible tracker', function () {
Http::fake([
'https://plausible.io/api/event' => Http::response('ok', 202),
]);
$this->call('POST', '/api/event', [], [], [], ['CONTENT_TYPE' => 'text/plain'], json_encode([
'n' => 'pageview',
'u' => 'https://example.com/page',
'd' => 'example.com',
'r' => null,
]))->assertStatus(202);
Http::assertSent(fn ($request) => $request->url() === 'https://plausible.io/api/event'
&& $request['n'] === 'pageview'
&& $request['u'] === 'https://example.com/page'
&& $request['d'] === 'example.com');
});
it('responds with 400 for invalid text/plain events', function () {
Http::fake();
$this->call('POST', '/api/event', [], [], [], ['CONTENT_TYPE' => 'text/plain'], 'not-json')
->assertStatus(400);
Http::assertNothingSent();
});
it('handles a trailing slash in the domain when forwarding events', function () {
config()->set('plausible-proxy.domain', 'https://plausible.example.com/');
Http::fake([
'https://plausible.example.com/api/event' => Http::response('ok', 202),
]);
$this->postJson('/api/event', [
'n' => 'pageview',
'u' => 'https://example.com/page',
'd' => 'example.com',
])->assertStatus(202);
Http::assertSent(fn ($request) => $request->url() === 'https://plausible.example.com/api/event');
});
it('responds with 502 when plausible is unreachable', function () {
Http::fake(fn () => throw new ConnectionException('Connection refused'));
$this->postJson('/api/event', [
'n' => 'pageview',
'u' => 'https://example.com/page',
'd' => 'example.com',
])->assertStatus(502);
});