Skip to content

Instantly share code, notes, and snippets.

@fhferreira
Forked from DavidMRGaona/SecureHeaders.php
Created July 21, 2023 04:27
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save fhferreira/11e8639f668935927e6e98fd61b583a4 to your computer and use it in GitHub Desktop.
Save fhferreira/11e8639f668935927e6e98fd61b583a4 to your computer and use it in GitHub Desktop.
Laravel Middleware to add/remove headers
<?php
namespace App\Http\Middleware;
use Closure;
class SecureHeaders
{
// Enumerate unwanted headers
private $unwantedHeaderList = [
'X-Powered-By',
'Server',
];
/**
* Handle an incoming request.
*
* @param \Illuminate\Http\Request $request
* @param \Closure $next
* @return mixed
*/
public function handle($request, Closure $next)
{
$response = $next($request);
$response->headers->set('X-Content-Type-Options', 'nosniff');
$response->headers->set('X-XSS-Protection', '1; mode=block');
$response->headers->set('Strict-Transport-Security', 'max-age:31536000; includeSubDomains');
$response->headers->set('Public-Key-Pins', 'pin-sha256="base64=' . env('SUBJECT_PUBLIC_KEY_INFORMATION_FINGERPRINT') . '"; max-age=31536000; includeSubDomains');
$this->removeUnwantedHeaders($this->unwantedHeaderList);
return $response;
}
/**
* @param $headerList
*/
private function removeUnwantedHeaders($headerList)
{
foreach ($headerList as $header)
header_remove($header);
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment