Skip to content

Instantly share code, notes, and snippets.

What would you like to do?
namespace App\Http\Middleware;
use Closure;
class SecureHeaders
// Enumerate headers which you do not want in your application's responses.
// Great starting point would be to go check out @Scott_Helme's:
private $unwantedHeaderList = [
public function handle($request, Closure $next)
$response = $next($request);
$response->headers->set('Referrer-Policy', 'no-referrer-when-downgrade');
$response->headers->set('X-Content-Type-Options', 'nosniff');
$response->headers->set('X-XSS-Protection', '1; mode=block');
$response->headers->set('X-Frame-Options', 'DENY');
$response->headers->set('Strict-Transport-Security', 'max-age:31536000; includeSubDomains');
$response->headers->set('Content-Security-Policy', "style-src 'self'"); // Clearly, you will be more elaborate here.
return $response;
private function removeUnwantedHeaders($headerList)
foreach ($headerList as $header)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment