97 lines
3.6 KiB
PHP
97 lines
3.6 KiB
PHP
<?php
|
|
|
|
namespace App\Http\Middleware;
|
|
|
|
use Closure;
|
|
use Illuminate\Http\Request;
|
|
use Illuminate\Support\Facades\Route;
|
|
use Illuminate\Support\Facades\View;
|
|
use Illuminate\Support\Facades\Vite;
|
|
use Symfony\Component\HttpFoundation\Response;
|
|
|
|
class SecureHeaders
|
|
{
|
|
private $unwantedHeaderList = [
|
|
'X-Powered-By',
|
|
'Server',
|
|
];
|
|
|
|
public function handle(Request $request, Closure $next): Response
|
|
{
|
|
// * For Vite DEV
|
|
$host = \parse_url((string) \config('app.url'), \PHP_URL_HOST);
|
|
|
|
$viteDevOrigin = config('app.debug') && \is_string($host) && $host !== '' ? "https://{$host}:4443" : null;
|
|
$viteDevSocket = config('app.debug') && \is_string($host) && $host !== '' ? "wss://{$host}:4443" : null;
|
|
|
|
View::share('nonce', $nonce = Vite::useCspNonce());
|
|
|
|
// * For VueJS dev tool to execute
|
|
$jsDev = config('app.debug') ? "'unsafe-eval' 'unsafe-inline'" : "'nonce-{$nonce}' 'strict-dynamic'";
|
|
$scheme = config('app.env') === 'local' ? 'http' : 'https';
|
|
$reportUri = Route::has('cspReportUri') ? \sprintf(' report-uri %s ;', \parse_url(route('cspReportUri'), \PHP_URL_PATH)) : '';
|
|
|
|
$this->removeUnwantedHeaders($this->unwantedHeaderList);
|
|
$response = $next($request);
|
|
|
|
$response->headers->set('Referrer-Policy', 'no-referrer-when-downgrade');
|
|
$response->headers->set('X-Content-Type-Options', 'nosniff');
|
|
$response->headers->set('X-XSS-Protection', '1; mode=block');
|
|
$response->headers->set('X-Frame-Options', 'SAMEORIGIN');
|
|
$response->headers->set('Strict-Transport-Security', 'max-age=31536000; includeSubDomains;');
|
|
|
|
// Utilisation de array_filter pour ne pas inclure les valeurs null en production
|
|
$cspPolicies = [
|
|
"default-src 'none';",
|
|
"manifest-src 'self';",
|
|
"connect-src 'self' blob: " . implode(' ', array_filter([
|
|
$viteDevSocket,
|
|
$viteDevOrigin,
|
|
'https://yl.s-web.fr'
|
|
])) . ';',
|
|
"img-src 'self' data: blob: " . implode(' ', array_filter([
|
|
$viteDevOrigin,
|
|
])) . ';',
|
|
"object-src 'self';",
|
|
"frame-src 'self' " . implode(' ', [
|
|
'https://www.google.com/recaptcha/',
|
|
'https://recaptcha.google.com/recaptcha/',
|
|
'https://www.google.com/maps/'
|
|
]) . ';',
|
|
"font-src 'self' data: " . implode(' ', array_filter([
|
|
$viteDevOrigin,
|
|
'https://fonts.gstatic.com' // <-- Point-virgule retiré ici
|
|
])) . ';',
|
|
"style-src 'self' 'unsafe-inline' " . implode(' ', array_filter([
|
|
'https://cdnjs.cloudflare.com',
|
|
'https://fonts.googleapis.com',
|
|
'https://cdn.jsdelivr.net',
|
|
'https://use.fontawesome.com',
|
|
$viteDevOrigin,
|
|
])) . ';',
|
|
"script-src 'self' {$jsDev} " . implode(' ', array_filter([
|
|
'https:',
|
|
'blob:',
|
|
'https://www.googletagmanager.com',
|
|
'https://cdnjs.cloudflare.com',
|
|
"$scheme://www.google-analytics.com",
|
|
$viteDevOrigin,
|
|
])) . ';'
|
|
];
|
|
|
|
$response->headers->set(
|
|
'Content-Security-Policy',
|
|
implode(' ', $cspPolicies) . $reportUri
|
|
);
|
|
$response->headers->set('Feature-Policy', 'fullscreen \'self\';');
|
|
|
|
return $response;
|
|
}
|
|
|
|
private function removeUnwantedHeaders(array $headerList): void
|
|
{
|
|
foreach ($headerList as $header) {
|
|
header_remove($header);
|
|
}
|
|
}
|
|
}
|