Code Coverage for /home/jeremy/projets/crm/app/Http/Middleware/ApiCheckTimeStamps.php

1	<?php
2
3	namespace App\Http\Middleware;
4
5	use App\Enums\ApiError;
6	use App\Exceptions\Api\V2\ApiErrorException;
7	use App\Lib\Helper;
8	use Illuminate\Http\Request;
9	use Illuminate\Support\Carbon;
10
11	/**
12	* Check Http Header Timestamp with request timestamp
13	* to prevent replay attacks
14	* https://restfulapi.net/security-essentials/
15	*/
16	class ApiCheckTimeStamps
17	{
18	/**
19	* Handle an incoming request.
20	*
21	* @param \Illuminate\Http\Request $request
22	* @param \Closure $next
23	* @return mixed
24	* @throws ApiErrorException With ApiError::wrongTimeStamp if timestamp has an incorrect format or is timed out.
25	*/
26	public function handle(Request $request, \Closure $next)
27	{
28	if (Helper::isRequestForApiV2($request)) {
29	if (!\is_string($request->timestamp) or !Carbon::hasFormat($request->timestamp, 'Y-m-d H:i:s')) {
30	throw new ApiErrorException(ApiError::wrongTimeStamp());
31	}
32	if (
33	Carbon::parse($request->timestamp, 'utc')
34	->isBefore(Carbon::now('UTC')->subSeconds(config('api.timestampTimeout', 10)))
35	) {
36	throw new ApiErrorException(ApiError::wrongTimeStamp());
37	}
38	}
39	return $next($request);
40	}
41	}