Presence

Enable presence

Enable presence support in the Conveyor server options when starting Conveyor in Pusher mode. Full examples are in Laravel Echo / Reverb and Pusher Protocol.

Constants::USE_PRESENCE => true,

Subscribe to a presence channel

window.Echo.join('room.1')
  .here(users => console.log('here', users))
  .joining(user => console.log('joining', user))
  .leaving(user => console.log('leaving', user))
  .listenForWhisper('typing', event => console.log('typing', event))

To send a whisper, call .whisper() on the joined channel with an event name and payload:

window.Echo.join('room.1').whisper('typing', { typing: true })

Authorize presence channels

After checking that the authenticated user may join the requested room, return an array identifying that user; return false when access is denied. Derive identity from Laravel’s authenticated $user, never from a client-supplied user ID or role. Every field returned is shared with other room members: allowlist only a public identifier and the display name needed by the interface. Do not return the full user model, email addresses, tokens, or internal permissions.

use Illuminate\Support\Facades\Broadcast;

Broadcast::channel('room.{roomId}', function ($user, int $roomId) {
    // Apply your application’s room-access policy before returning user data.
    return [
        'id' => $user->id,
        'name' => $user->name,
        // Only these public fields are shared with room members.
    ];
});

Laravel's /broadcasting/auth endpoint, which Echo points to, performs the authorization. Conveyor only checks the Pusher-style signature on the WebSocket subscription request, using the app secret.

Client events (whispers)

Treat every whisper payload as untrusted client input, even on an authorized channel. Allowlist event names and fields, validate types and payload size, and rate-limit handling. For the typing example, accept only a boolean typing field; ignore malformed payloads and render any client text as text, never HTML. A payload’s claimed user ID, name, or role does not establish identity or permissions. Use whispers only for temporary UI hints. Send authoritative actions through an authenticated server endpoint that checks identity, room access, and permissions.

Whispers on presence and private channels require client messages to be enabled for the app:

'apps' => [[
    // ...
    'enable_client_messages' => true,
]],

Query current presence members

Fetch current members through the Pusher-compatible REST API:

Requests must be signed with the app key and secret. See HTTP Requests for the required query parameters and signing.

See also