Docs·Proxy guide

Proxy with Laravel

One route serves Spreelytics from /sp/. It skips the session and CSRF middleware, since tracking requests carry no session. This guide uses /sp/. Any path works if nothing else on your site uses it and it doesn't contain words like "analytics" or "tracking", which blockers look for.

Add the route

Add this to routes/web.php, with the use lines at the top of the file:

use Illuminate\Foundation\Http\Middleware\ValidateCsrfToken;
use Illuminate\Http\Request;
use Illuminate\Session\Middleware\StartSession;
use Illuminate\Support\Facades\Http;
use Illuminate\Support\Facades\Route;
use Illuminate\View\Middleware\ShareErrorsFromSession;

// Serves Spreelytics from /sp/ on your site: /sp/js/ is the script, everything else is tracking.
Route::any('/sp/{path}', function (Request $request, string $path) {
    $url = str_starts_with($path, 'js/')
        ? 'https://cdn.spreelytics.com/cdn/sdk/'.substr($path, 3)
        : 'https://sdk.spreelytics.com/1.0/'.$path;
    if ($query = $request->server('QUERY_STRING')) {
        $url .= '?'.$query;
    }

    $http = Http::withHeaders(array_filter([
        'User-Agent' => $request->userAgent(),
        'Origin' => $request->header('Origin'),
        'Referer' => $request->header('Referer'),
        'Accept' => $request->header('Accept'),
        'Accept-Language' => $request->header('Accept-Language'),
        // The visitor's IP address. Behind a load balancer or CDN, set up trusted proxies.
        'X-Forwarded-For' => $request->ip(),
    ]));
    if (! in_array($request->method(), ['GET', 'HEAD'])) {
        $http = $http->withBody($request->getContent(), $request->header('Content-Type', 'text/plain'));
    }
    $upstream = $http->send($request->method(), $url);

    return response($upstream->body(), $upstream->status())->withHeaders(array_filter([
        'Content-Type' => $upstream->header('Content-Type'),
        'Cache-Control' => $upstream->header('Cache-Control'),
    ]));
})->where('path', '.*')->withoutMiddleware([ValidateCsrfToken::class, StartSession::class, ShareErrorsFromSession::class]);

Point the script at your proxy

In your Spreelytics snippet, load the script through /sp/js/ and add api_host:

<script src="/sp/js/spreelytics-loader.js"></script>
<script>
  Spreelytics.init({
    client_key: "YOUR_CLIENT_KEY",
    api_host: "https://www.example.com/sp",
  });
</script>

Check it works

Open your site with the browser's Network tab open and filtered by /sp/. The script files and requests like track/page should come from your own domain, with status 200. In Spreelytics, Settings → Tracking script says "Last seen just now" and Realtime shows you in your own country.

Wrong country, or 200 and nothing arrives: the proxy isn't passing the visitor's IP address in X-Forwarded-For. See The visitor's IP address below.
401: the Origin and Referer headers didn't arrive, or your domain isn't in Allowed domains.

The visitor's IP address

$request->ip() is the connection's address. Behind a load balancer or Cloudflare, trust it so Laravel reads X-Forwarded-For, or every visitor arrives from the load balancer's address.

Proxy overview: the other ways to set it up.
Filter traffic: which traffic Spreelytics drops.

PreviousProxy with Express Next Proxy with Django