Skip to content

Instantly share code, notes, and snippets.

@DavidMRGaona

DavidMRGaona/SecureHeaders.php

Created November 21, 2018 15:04
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save DavidMRGaona/0e70f2d40fb94ed29e454923f03c288f to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save DavidMRGaona/0e70f2d40fb94ed29e454923f03c288f to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. DavidMRGaona created this gist Nov 21, 2018.
    41 changes: 41 additions & 0 deletions SecureHeaders.php
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,41 @@
    <?php

    namespace App\Http\Middleware;

    use Closure;

    class SecureHeaders
    {
    // Enumerate unwanted headers
    private $unwantedHeaderList = [
    'X-Powered-By',
    'Server',
    ];

    /**
    * Handle an incoming request.
    *
    * @param \Illuminate\Http\Request $request
    * @param \Closure $next
    * @return mixed
    */
    public function handle($request, Closure $next)
    {
    $response = $next($request);
    $response->headers->set('X-Content-Type-Options', 'nosniff');
    $response->headers->set('X-XSS-Protection', '1; mode=block');
    $response->headers->set('Strict-Transport-Security', 'max-age:31536000; includeSubDomains');
    $response->headers->set('Public-Key-Pins', 'pin-sha256="base64=' . env('SUBJECT_PUBLIC_KEY_INFORMATION_FINGERPRINT') . '"; max-age=31536000; includeSubDomains');
    $this->removeUnwantedHeaders($this->unwantedHeaderList);
    return $response;
    }

    /**
    * @param $headerList
    */
    private function removeUnwantedHeaders($headerList)
    {
    foreach ($headerList as $header)
    header_remove($header);
    }
    }