45 lines
1.7 KiB
PHP
45 lines
1.7 KiB
PHP
<?php
|
|
|
|
namespace App\Http\Middleware;
|
|
|
|
use Closure;
|
|
|
|
class SecureHeaders
|
|
{
|
|
// Enumerate headers which you do not want in your application's responses.
|
|
// Great starting point would be to go check out @Scott_Helme's:
|
|
// https://securityheaders.com/
|
|
private $unwantedHeaderList = [
|
|
'X-Powered-By',
|
|
'Server',
|
|
];
|
|
|
|
public function handle($request, Closure $next)
|
|
{
|
|
$this->removeUnwantedHeaders($this->unwantedHeaderList);
|
|
$response = $next($request);
|
|
$response->headers->set('Referrer-Policy', 'no-referrer-when-downgrade');
|
|
$response->headers->set('X-Content-Type-Options', 'nosniff');
|
|
$response->headers->set('X-XSS-Protection', '1; mode=block');
|
|
$response->headers->set('X-Frame-Options', 'SAMEORIGIN');
|
|
$response->headers->set('Strict-Transport-Security', 'max-age=31536000; includeSubDomains;');
|
|
$cspPolicies = [
|
|
"style-src 'self' 'unsafe-inline' https://cdnjs.cloudflare.com https://fonts.googleapis.com;",
|
|
// phpcs:ignore Generic.Files.LineLength.TooLong
|
|
"script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdnjs.cloudflare.com https://www.googletagmanager.com https://www.google-analytics.com https://maps.googleapis.com https://fonts.googleapis.com;"
|
|
];
|
|
$response->headers->set(
|
|
'Content-Security-Policy',
|
|
implode(' ', $cspPolicies)
|
|
);
|
|
$response->headers->set('Feature-Policy', 'fullscreen \'self\';');
|
|
return $response;
|
|
}
|
|
|
|
private function removeUnwantedHeaders($headerList)
|
|
{
|
|
foreach ($headerList as $header) {
|
|
header_remove($header);
|
|
}
|
|
}
|
|
}
|