ldc-bien-etre-animal/app/Http/Middlewares/SecureHeaders.php

<?php

declare(strict_types=1);

namespace App\Http\Middlewares;

use Closure;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Route;
use Illuminate\Support\Facades\Vite;
use Symfony\Component\HttpFoundation\Response;

/**
 * Applies security-related HTTP response headers (CSP, HSTS, X-Frame-Options, etc.)
 * and removes sensitive server headers.
 */
class SecureHeaders
{
    /**
     * Enumerate headers which you do not want in your application's responses.
     * Great starting point would be to go check out @Scott_Helme's:
     * https://securityheaders.com/
     *
     * @var list<string>
     */
    private $unwantedHeaderList = [
        'X-Powered-By',
        'Server',
    ];

    /**
     * Handle an incoming request.
     *
     * @param  \Closure(\Illuminate\Http\Request): (\Symfony\Component\HttpFoundation\Response)  $next
     *
     * @phpcs:disable Squiz.Commenting.FunctionComment.IncorrectTypeHint
     */
    public function handle(Request $request, Closure $next): Response
    {
        // phpcs:enable

        // * Setup Laravel Nonce
        Vite::useCspNonce();

        $this->removeUnwantedHeaders($this->unwantedHeaderList);

        $response = $next($request);

        $this->setMandatoryHeaders($response);
        $this->setCspHeaders($response);
        $this->setFeatureHeaders($response);

        return $response;
    }

    private function setFeatureHeaders(Response $response): void
    {
        $response->headers->set('Feature-Policy', 'fullscreen \'self\';');
    }

    // phpcs:ignore Generic.Metrics.CyclomaticComplexity.TooHigh
    private function setCspHeaders(Response $response): void
    {
        // * For Vite DEV
        $host  = \parse_url((string) \config('app.url'), \PHP_URL_HOST);
        $nonce = Vite::cspNonce();

        $jsDev = config('app.debug')
            ? "'unsafe-eval' 'unsafe-inline'"
            : "'nonce-{$nonce}' 'strict-dynamic'";

        $cspPolicies = [
            "default-src 'none';",
            // NOTE: Base Uri est indépendante de default-src
            "base-uri 'none';",
            "form-action 'self';",
            "manifest-src 'self';",
            "media-src 'self' data: blob: " . implode(' ', [
                // * VITE DEV
                config('app.debug') ? "https://{$host}:4443" : '',
                // * REMOTE ASSETS
                config('app.asset_origin', ''),
            ]) . ';',
            // * CKEDITOR Specific https://ckeditor.com/docs/ckeditor5/latest/installation/advanced/csp.html
            "connect-src 'self' blob: " . implode(' ', array_filter([
                'https://maps.googleapis.com',
                'https://www.google.com/recaptcha/',
                'https://recaptcha.google.com/recaptcha/',
                'https://yl.s-web.fr',
                'https://www.google-analytics.com',
                config('app.debug') ? "wss://{$host}:4443" : '',
                config('app.debug') ? "https://{$host}:4443" : '',
            ])) . ';',
            "img-src 'self' data: blob: " . implode(' ', array_filter([
                'https://www.google.com/recaptcha/',
                'https://recaptcha.google.com/recaptcha/',
                'https://www.gstatic.com/recaptcha/',
                'https://www.google-analytics.com',
                'https://www.googletagmanager.com',
                config('app.debug') ? "https://{$host}:4443" : '',
                config('app.asset_origin', ''),
            ])) . ';',
            "object-src 'none';",
            "frame-ancestors 'self';",
            "frame-src 'self' " . implode(' ', [
                'https://www.google.com/recaptcha/',
                'https://recaptcha.google.com/recaptcha/',
            ]) . ';',
            "font-src 'self' data: " . \implode(' ', [
                'https://fonts.gstatic.com',
                // * VITE DEV
                config('app.debug') ? "https://{$host}:4443" : '',
                // * REMOTE ASSETS
                config('app.asset_origin', ''),
            ]) . ';',
            "style-src 'self' 'nonce-$nonce' 'unsafe-inline' https://fonts.googleapis.com " . implode(' ', [
                config('app.debug') ? "https://{$host}:4443" : '',
                config('app.asset_origin', ''),
            ]) . ';',
            "style-src-attr 'unsafe-inline';",
            "script-src 'self' {$jsDev} " . \implode(' ', [
                'https://www.google.com/recaptcha/',
                'https://www.gstatic.com/recaptcha/',
                'https://www.googletagmanager.com',
                'https://www.google-analytics.com',
                config('app.debug') ? "https://{$host}:4443" : '',
                // * REMOTE ASSETS
                config('app.asset_origin', ''),
            ]) . ';',
        ];
        $response->headers->set(
            'Content-Security-Policy',
            implode(' ', $cspPolicies) . $this->getReportUri()
        );
    }

    private function setMandatoryHeaders(Response $response): void
    {
        $response->headers->set('Referrer-Policy', 'strict-origin-when-cross-origin');
        $response->headers->set('X-Content-Type-Options', 'nosniff');
        $response->headers->set('X-XSS-Protection', '1; mode=block');
        $response->headers->set('X-Frame-Options', 'SAMEORIGIN');
        if (config('app.env') !== 'local') {
            $response->headers->set('Strict-Transport-Security', 'max-age=31536000; includeSubDomains;');
        }
    }

    private function getReportUri(): string
    {
        return Route::has('cspReportUri') ?
            \sprintf(' report-uri %s ;', \parse_url(route('cspReportUri'), \PHP_URL_PATH)) : '';
    }

    /**
     * Remove unwanted headers
     *
     * @param  list<string>  $headerList
     */
    private function removeUnwantedHeaders(array $headerList): void
    {
        foreach ($headerList as $header) {
            header_remove($header);
        }
    }
}