14four / laravel-force-host
Force Host header to prevent host header poisoning.
Requires (Dev)
- mockery/mockery: ^1.1
- orchestra/testbench: ^3.7
This package is not auto-updated.
Last update: 2024-04-28 03:36:13 UTC
README
Installation
1. Require Laravel Force Host with composer.
composer require 14four/laravel-force-host
2. Open your config/app.php and add the following to the providers array:
note: Laravel > 5.5 skip this step
FourteenFour\ForceHost\ForceHostServiceProvider::class,
3. Publish Config
php artisan vendor:publish --provider="FourteenFour\ForceHost\ForceHostServiceProvider"
4. Add middleware to kernel.php
\FourteenFour\ForceHost\Middleware\ForceHost::class,
note: this should probably be added to the 'web' middleware
Config
Open the config/forcehost.php configuration file to customize the config.
Enable
enable will allow you to turn on and off the Force Host functionality of the middleware.
By default this uses the environment variable FORCE_HOST.
Use the following to disable the Force Host functionality.
FORCE_HOST=false
Host
host is used to specify the domain in which you intend to force on the host header attribute via the Force Host middleware.
By default this uses the environment variable FORCE_HOST_DOMAIN.
Use the following to change the host you intend to force.
FORCE_HOST_DOMAIN=www.DoritosMadden19.com
Except
This will allow you to provide regex patterns that will be excluded from the Force Host functionality.
Example:
$except = [
'14four.com',
],
Keep in mind this will match the fullUrl not just the domain. The example above will match http://14four.com and http://example.com/post?14four.com