---
title: "Responses & data URIs — QR for Laravel | Roundly"
description: "Return codes as hardened image/svg+xml responses, force downloads, embed data URIs and img tags, and build a safe host route."
url: https://roundly-consulting.com/open-source/docs/qr-for-laravel/responses
language: en
---

[All packages](https://roundly-consulting.com/open-source.md)

[QR for Laravel](https://roundly-consulting.com/open-source/docs/qr-for-laravel.md)

# Responses & data URIs

Return a builder or an Svg from a controller and it becomes an image response; the same object also yields data URIs and img tags:

```php
return Qr::url($link);                                   // inline image/svg+xml
return Qr::url($link)->svg()->download('table-12.svg');  // attachment

return response()->json(['qr' => Qr::url($link)->toDataUri()]);
$base64 = Qr::url($link)->toDataUri(DataUriEncoding::Base64);
$img = Qr::url($link)->svg()->toImgTag('Scan me', ['class' => 'w-32']);
$svg = Qr::url($link)->svg()->withAttributes(['class' => 'qr', 'aria-hidden' => 'true']);
$etag = $svg->etag();
```

## Response headers

| Header | Public | Personal | Secret |
| --- | --- | --- | --- |
| `Content-Type` | image/svg+xml; charset=utf-8 | same | same |
| `Cache-Control` | public, max-age=… (+ immutable) | private, max-age=… | no-store, max-age=0 |
| `ETag / 304` | yes | yes | no (Pragma: no-cache) |
| `X-Content-Type-Options` | nosniff | nosniff | nosniff |
| `Content-Security-Policy` | `default-src 'none'; style-src 'unsafe-inline'` | same | same |
| `Content-Disposition` | inline; filename=qr-code.svg (attachment for download()) | same | same |

Response bodies always carry the XML declaration. Download filenames are sanitised with an ASCII fallback. max-age comes from response.max\_age, and immutable is appended when response.immutable is true.

## A host route for user input

The package ships no routes. A host route that renders user input should authenticate, throttle and validate:

```php
use RoundlyConsulting\Qr\Rules\FitsInQrCode;

Route::middleware(['auth', 'throttle:30,1'])->get('/qr', function (Request $request) {
    $data = $request->validate(['text' => ['required', 'string', new FitsInQrCode]]);

    return Qr::text($data['text']);
});
```

## Show your open-source love

This package is free and MIT-licensed. If it saves you time, a one-off donation or a Patreon membership keeps it maintained, tested and documented.

[More ways to support, including crypto](https://roundly-consulting.com/support-us.md)

By donating, you agree to our [donation terms](https://roundly-consulting.com/donation-terms.md).

[Support our open source work (opens in a new tab)](https://donate.stripe.com/dRmeVe8FX5PF1Qd9pXcEw00) [Join us on Patreon (opens in a new tab)](https://www.patreon.com/cw/roundly)

## Want this built into your product?

We integrate our packages into custom Laravel and AI builds. Tell us what you're working on and we'll reply within 48 hours.

[Get a quote in 48 hours](https://roundly-consulting.com/contact.md) [Browse all packages](https://roundly-consulting.com/open-source/docs/qr-for-laravel.md)