97 lines
3.5 KiB
PHP
97 lines
3.5 KiB
PHP
<?php
|
|
|
|
namespace App\Http\Middleware;
|
|
|
|
use Closure;
|
|
use Illuminate\Http\Request;
|
|
use Illuminate\Support\Facades\Route;
|
|
use Illuminate\Support\Facades\View;
|
|
|
|
class SecureHeaders
|
|
{
|
|
/**
|
|
* Enumerate headers which you do not want in your application's responses.
|
|
* Great starting point would be to go check out @Scott_Helme's:
|
|
* https://securityheaders.com/
|
|
*
|
|
* @var array
|
|
*/
|
|
private $unwantedHeaderList = [
|
|
'X-Powered-By',
|
|
'Server',
|
|
];
|
|
|
|
/**
|
|
* Handle an incoming request.
|
|
*
|
|
* @param \Illuminate\Http\Request $request
|
|
* @param \Closure $next
|
|
* @return \Illuminate\Http\Response|\Illuminate\Http\RedirectResponse
|
|
*/
|
|
public function handle(Request $request, Closure $next)
|
|
{
|
|
View::share('nonce', $nonce = \uniqid());
|
|
// * For VueJS dev tool to execute
|
|
$jsDev = config('app.debug') ? "'unsafe-eval' 'unsafe-inline'" : "'nonce-$nonce'";
|
|
$cssDev = config('app.debug') ? "'unsafe-inline'" : "'nonce-$nonce'";
|
|
$reportUri = Route::has('cspReportUri') ?
|
|
\sprintf('report-uri %s', \parse_url(route('cspReportUri'), \PHP_URL_PATH)) : '';
|
|
$this->removeUnwantedHeaders($this->unwantedHeaderList);
|
|
$response = $next($request);
|
|
$response->headers->set('Referrer-Policy', 'no-referrer-when-downgrade');
|
|
$response->headers->set('X-Content-Type-Options', 'nosniff');
|
|
$response->headers->set('X-XSS-Protection', '1; mode=block');
|
|
$response->headers->set('X-Frame-Options', 'SAMEORIGIN');
|
|
$response->headers->set('Strict-Transport-Security', 'max-age=31536000; includeSubDomains;');
|
|
$cspPolicies = [
|
|
"default-src 'self' https://www.youtube.com;",
|
|
"manifest-src 'self';",
|
|
// * CKEDITOR Specific https://ckeditor.com/docs/ckeditor5/latest/installation/advanced/csp.html
|
|
"connect-src 'self' https://www.youtube.com https://yl.s-web.fr blob:;",
|
|
"img-src * https://yl.s-web.fr data: blob:;",
|
|
// "frame-src https://www.youtube.com;",
|
|
"font-src 'self';",
|
|
// ! Using CKEditor will must have unsafe-inline style
|
|
// phpcs:ignore Generic.Files.LineLength.TooLong
|
|
"style-src 'self' 'unsafe-inline';",
|
|
// ! If you dont use ckeditor use this
|
|
// "style-src 'self' $cssDev;",
|
|
// phpcs:ignore Generic.Files.LineLength.TooLong
|
|
'script-src ' . implode(" ", [
|
|
'\'self\'',
|
|
'https://yl.s-web.fr'
|
|
]) . ' ' . $jsDev . ';'
|
|
|
|
];
|
|
$response->headers->set(
|
|
'Content-Security-Policy',
|
|
implode(' ', $cspPolicies) . $reportUri
|
|
);
|
|
$response->headers->set(
|
|
'Feature-Policy',
|
|
implode('; ', [
|
|
'fullscreen https://www.youtube.com',
|
|
'accelerometer https://www.youtube.com',
|
|
'autoplay https://www.youtube.com',
|
|
'clipboard-write https://www.youtube.com',
|
|
'encrypted-media https://www.youtube.com',
|
|
'gyroscope https://www.youtube.com',
|
|
'picture-in-picture https://www.youtube.com'
|
|
])
|
|
);
|
|
return $response;
|
|
}
|
|
|
|
/**
|
|
* Remove unwanted headers
|
|
*
|
|
* @param array $headerList
|
|
* @return void
|
|
*/
|
|
private function removeUnwantedHeaders(array $headerList)
|
|
{
|
|
foreach ($headerList as $header) {
|
|
header_remove($header);
|
|
}
|
|
}
|
|
}
|