Skip to content

Instantly share code, notes, and snippets.

@DavidMRGaona
Created November 21, 2018 15:04
Show Gist options
  • Star 8 You must be signed in to star a gist
  • Fork 3 You must be signed in to fork a gist
  • Save DavidMRGaona/0e70f2d40fb94ed29e454923f03c288f to your computer and use it in GitHub Desktop.
Save DavidMRGaona/0e70f2d40fb94ed29e454923f03c288f to your computer and use it in GitHub Desktop.
Laravel Middleware to add/remove headers
<?php
namespace App\Http\Middleware;
use Closure;
class SecureHeaders
{
// Enumerate unwanted headers
private $unwantedHeaderList = [
'X-Powered-By',
'Server',
];
/**
* Handle an incoming request.
*
* @param \Illuminate\Http\Request $request
* @param \Closure $next
* @return mixed
*/
public function handle($request, Closure $next)
{
$response = $next($request);
$response->headers->set('X-Content-Type-Options', 'nosniff');
$response->headers->set('X-XSS-Protection', '1; mode=block');
$response->headers->set('Strict-Transport-Security', 'max-age:31536000; includeSubDomains');
$response->headers->set('Public-Key-Pins', 'pin-sha256="base64=' . env('SUBJECT_PUBLIC_KEY_INFORMATION_FINGERPRINT') . '"; max-age=31536000; includeSubDomains');
$this->removeUnwantedHeaders($this->unwantedHeaderList);
return $response;
}
/**
* @param $headerList
*/
private function removeUnwantedHeaders($headerList)
{
foreach ($headerList as $header)
header_remove($header);
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment