oihana/php-middleware

Composable PHP middleware helpers — security headers (HSTS, CSP, X-Frame-Options, Referrer-Policy, X-Content-Type-Options), CORS with preflight, CSRF, request-id, maintenance mode, rate limiting. PSR-7 compatible, zero magic strings.

0.3.0 2026-05-27 16:54 UTC

Requires

• php: >=8.4
• oihana/php-enums: dev-main
• oihana/php-http: dev-main
• psr/http-message: ^2.0

Requires (Dev)

• nunomaduro/collision: ^8.8
• phpdocumentor/shim: ^3.8
• phpunit/phpunit: ^12
• slim/psr7: ^1.7

Suggests

• oihana/php-memcached: Provides MemcachedRateLimitStore (production-grade backend for enforceRateLimit()).

MPL-2.0

• Marc Alcaraz

• php
• http
• security
• cors
• middleware
• maintenance
• csrf
• csp
• psr-7
• hsts
• request-id
• rate-limiting
• rate-limit
• security-headers

README

Composable PHP HTTP middleware helpers. Part of the Oihana PHP ecosystem, this package ships procedural helpers to build typed security-headers responses and apply CORS with preflight handling — PSR-7 compatible, zero magic strings.

📚 Documentation

Full API reference (generated with phpDocumentor): https://bcommebois.github.io/oihana-php-middleware

User guides (FR + EN) live under wiki/.

📦 Installation

Requires PHP 8.4+. Install via Composer:

composer require oihana/php-middleware

✨ What you can do

Security headers

• withSecurityHeaders() — single helper to apply HSTS, Content-Security-Policy, X-Frame-Options, Referrer-Policy, X-Content-Type-Options to a PSR-7 Response in one call. Typed values via ReferrerPolicy and FrameOptions enums — no magic strings.
• buildCspHeader() — compose a Content-Security-Policy value from an associative array of directives. CspDirective enum exposes the canonical directive names.

CORS

• applyCorsHeaders() — origin allowlist with configurable methods, headers, exposed headers, credentials and max-age. Handles the preflight OPTIONS request automatically. Defensive defaults: no * when credentials = true, Vary: Origin added when the allowlist is dynamic.

Under the hood

• Pure PSR-7 — no framework lock-in. Works with Slim, Laravel, Symfony HTTP Foundation (via PSR-7 bridge), Hyperf, RoadRunner, etc.
• Built on oihana/php-http primitives (isHttpsRequest, etc.) and oihana/php-enums typed HTTP header constants.

✅ Running tests

Run all tests:

composer test

🛠️ Generate the documentation

composer doc

🧾 License

Licensed under the Mozilla Public License 2.0 (MPL‑2.0).

👤 About the author

• Author: Marc ALCARAZ (aka eKameleon)
• Email: [e-mail]
• Website: https://www.ooop.fr

🔗 Related packages

Package	Description
oihana/php-http	Composable PHP HTTP primitives (client IP detection, signed URLs, cookies, content negotiation, …) consumed by this library.
oihana/php-enums	Typed HTTP constants (HttpHeader, …).