Weave Code
Laravel Force Host Laravel Package
14four/laravel-force-host
Middleware for Laravel that forces a single canonical host for all requests. Automatically redirects to your configured domain (and optionally scheme), preventing duplicate URLs across www/non-www and improving SEO, cache consistency, and security.
Force Host header to prevent host header poisoning.
Frequently asked questions about Laravel Force Host
- How do I enforce a single host (e.g., `www` or non-`www`) in Laravel to avoid duplicate content?
- Add the `ForceHost` middleware to your Laravel `app/Http/Kernel.php` and configure the `FORCE_HOST` environment variable (e.g., `FORCE_HOST=example.com`). The package will automatically redirect all requests to the configured host, ensuring consistency and preventing SEO issues from duplicate URLs.
- Does this package work with Laravel 8/9/10, or is it limited to older versions?
- This package is designed for Laravel 5.5+ and is fully compatible with Laravel 8, 9, and 10. It leverages Laravel’s middleware pipeline (PSR-15 compliant), so no framework-specific changes are required beyond adding the middleware to your stack.
- Can I use this for multi-tenant applications where tenants have subdomains (e.g., `tenant1.example.com`)?
- Yes, but with caution. The package enforces a single host by default. For multi-tenant setups, you can dynamically set `FORCE_HOST` per tenant or use a wildcard (e.g., `FORCE_HOST=*.example.com`). However, test thoroughly to avoid unintended redirects, as strict enforcement may conflict with tenant isolation.
- How do I configure this package for local development vs. production environments?
- Use Laravel’s environment detection to conditionally enable the middleware. For example, only add `ForceHost` to the middleware stack in production by checking `app()->environment('production')`. Alternatively, set `FORCE_HOST` in your `.env` file to `null` or a local domain (e.g., `FORCE_HOST=localhost`) for development.
- Will this package break my existing trusted proxies (e.g., Nginx, Cloudflare) or X-Forwarded-* headers?
- No, the package respects Laravel’s `trustedProxies` configuration. If your reverse proxy (e.g., Nginx) forwards the `Host` header via `X-Forwarded-Host`, ensure the proxy is listed in Laravel’s `trustedProxies` array. The package will use the forwarded host if trusted, falling back to the original `Host` header otherwise.
- Can I customize the redirect behavior (e.g., preserve query strings, handle HTTPS/HTTP)?
- The package automatically handles redirects while preserving query strings and path segments. It also respects the `FORCE_SCHEME` environment variable (e.g., `FORCE_SCHEME=https`) to enforce HTTPS. No additional configuration is needed for basic use cases, but you can extend the middleware for advanced logic if required.
- Is this package secure enough to prevent host header poisoning attacks?
- Yes, this package acts as a defense-in-depth measure against host header poisoning by validating and enforcing a single canonical host. It should be used alongside Laravel’s built-in `trustedProxies` middleware and other security layers (e.g., `VerifyCsrfToken`). For APIs or high-security environments, combine it with additional validation logic.
- How do I test this middleware to ensure it redirects correctly?
- Write unit tests for the middleware by mocking a request with an invalid host and asserting the redirect. For example, use Laravel’s `Testing` facade to simulate a request to `evil.com` and verify it redirects to your configured host. Example: `$response = $this->get('http://evil.com'); $response->assertRedirect('https://example.com');`
- Are there alternatives to this package for enforcing canonical hosts in Laravel?
- Yes, alternatives include custom middleware using Laravel’s `Redirector` or packages like `spatie/laravel-honeypot` (for security-focused redirects). However, this package is lightweight, purpose-built for host enforcement, and integrates seamlessly with Laravel’s middleware stack without requiring additional dependencies.
- How do I handle edge cases like wildcard subdomains (e.g., `*.app.example.com`) or dynamic hosts?
- For wildcard subdomains, set `FORCE_HOST=*.example.com` in your `.env` file. For dynamic hosts (e.g., user-specific subdomains), extend the middleware by overriding the `validateHost` method or use a callback to validate hosts programmatically. Example: `ForceHost::validate($host)` can be customized in a service provider.
Weaver
How can I help you explore Laravel packages today?