Laravel Force Https Laravel Package

Getting Started

Minimal Setup

1. Installation

   composer require 14four/laravel-force-https
   

   Publish the config file (if needed):

   php artisan vendor:publish --provider="14Four\ForceHttps\ForceHttpsServiceProvider"
   

2. Basic Usage Add the middleware to your app/Http/Kernel.php:

   protected $middleware = [
       // ...
       \FourteenFour\ForceHttps\ForceHttpsMiddleware::class,
   ];
   

3. First Use Case Immediately enforce HTTPS for all requests to your Laravel app. No additional configuration is required for default behavior.

Implementation Patterns

Core Workflows

1. Domain-Specific Rules Override default behavior via config/force-https.php:

   'domains' => [
       'app.example.com' => true,  // Force HTTPS
       'staging.example.com' => false, // Allow HTTP
   ],
   

2. Conditional Enforcement Use middleware groups or route-specific middleware:

   Route::middleware(['force.https'])->group(function () {
       // Routes requiring HTTPS
   });
   

3. Custom Logic via Events Extend functionality by listening to https-forced events:

   event(new \FourteenFour\ForceHttps\Events\HttpsForced($request, $response));
   

Integration Tips

• Reverse Proxy Support If behind Nginx/Apache, ensure X-Forwarded-Proto headers are trusted:

  'trusted_proxies' => ['192.168.1.1'], // Your proxy IP
  

• Local Development Exclude local domains (e.g., localhost, *.test) from HTTPS enforcement:

  'exceptions' => [
      'localhost',
      '*.test',
  ],
  

• API Endpoints Disable HTTPS for internal APIs:

  Route::middleware(['api', 'throttle', 'force.https:disable'])->group(...);
  

Gotchas and Tips

Pitfalls

1. Mixed Content Warnings

   • Ensure all assets (CSS/JS/images) are loaded via HTTPS to avoid browser warnings.
   • Use Laravel Mix’s mix.options.https = true or secure_assets() helper.

2. Redirect Loops

   • If using subdomains, ensure DNS records point to the correct server (no HTTP → HTTPS → HTTP cycles).
   • Debug with:

     php artisan route:list | grep force.https
     

3. Caching Headers

   • Clear cache after enabling HTTPS:

     php artisan cache:clear
     php artisan config:clear
     

Debugging

• Log Redirects Enable debug mode in config/force-https.php:

  'debug' => env('APP_DEBUG', false),
  

  Check Laravel logs (storage/logs/laravel.log) for forced HTTPS events.

• Test with curl Verify redirects:

  curl -v http://yourdomain.com
  

Extension Points

1. Custom Middleware Extend the base middleware:

   namespace App\Http\Middleware;
   use FourteenFour\ForceHttps\ForceHttpsMiddleware;
   
   class CustomForceHttps extends ForceHttpsMiddleware {
       protected function shouldForceHttps($request) {
           // Custom logic
           return parent::shouldForceHttps($request);
       }
   }
   

2. Dynamic Rules Use a closure in config:

   'domains' => function ($request) {
       return $request->ip() === '123.123.123.123' ? false : true;
   },
   

3. Event Listeners Modify responses post-forcing:

   \Event::listen(\FourteenFour\ForceHttps\Events\HttpsForced::class, function ($event) {
       $event->response->headers->set('Strict-Transport-Security', 'max-age=31536000');
   });