- How do I install ilvalerione/laravel-https-redirect?
- Install the package with Composer using composer require ilvalerione/laravel-https-redirect. Laravel package discovery should register any service provider automatically. Then register the package middleware in your HTTP kernel or bootstrap configuration. Check the README for the exact middleware class and any publishable config file.
- How do I register the HTTPS redirect middleware in Laravel?
- Add the package middleware to your application's HTTP middleware stack or to a specific route group. In older Laravel versions this is typically done in app/Http/Kernel.php, while newer Laravel versions use bootstrap/app.php. Registering it globally enforces HTTPS for all matched requests. You can also apply it selectively to avoid redirecting webhooks or health checks.
- Which Laravel versions does laravel-https-redirect support?
- The package is built for Laravel applications, but exact version constraints are defined in its composer.json and README. Always check those constraints before installing or upgrading Laravel. If you are on an older or newer Laravel release, verify compatibility in the repository or test in a staging app first.
- How do I configure which environments redirect to HTTPS?
- Use the package configuration and your Laravel environment settings to control when the middleware is active. A common approach is to enable HTTPS redirects in production and staging while leaving local development flexible. You can also conditionally register the middleware or apply it only to specific route groups. Review the package config file for the available options.
- Will it work behind a load balancer or reverse proxy?
- Yes, but Laravel must be able to detect the original request scheme correctly. Configure trusted proxies so headers like X-Forwarded-Proto are honored, otherwise the app may think requests are still HTTP and create redirect loops. Make sure your load balancer forwards the original protocol header. Test the behavior in staging before enabling it in production.
- How do I test HTTPS redirects in Laravel feature tests?
- Write a feature test that makes an HTTP request and asserts a redirect to the HTTPS URL. For example, request http://example.com/foo and assert the response redirects to https://example.com/foo. You may need to disable or conditionally register the middleware for tests that expect plain HTTP responses. Keep separate tests for excluded routes and trusted proxy behavior.
- Can I exclude specific routes from the HTTPS redirect?
- Yes, because the package provides middleware, you can apply it only to the routes or route groups that should be forced to HTTPS. Exclude webhooks, health checks, and internal endpoints that may not support HTTPS. Avoid registering the middleware globally if you need fine-grained exceptions. This selective approach helps prevent unexpected redirects.
- How do I avoid redirect loops with HTTPS redirect middleware?
- Redirect loops usually happen when Laravel does not recognize that the original request was already HTTPS, often behind a proxy or load balancer. Configure trusted proxies and ensure the correct forwarded protocol headers reach the application. Also verify that your web server is not adding a conflicting redirect rule. Test with curl or browser dev tools to confirm the request scheme Laravel sees.
- What are alternatives to ilvalerione/laravel-https-redirect?
- You can enforce HTTPS at the web server level with Nginx or Apache redirect rules, which avoids application-level overhead. Another Laravel option is calling URL::forceScheme('https') in a service provider, or writing a small custom middleware. The package is useful when you want a lightweight, configurable middleware-based solution that is easy to register.
- Is laravel-https-redirect maintained and safe for production?
- Check the GitHub repository for recent commits, open issues, and Laravel compatibility notes before using it in production. Pin a specific version in composer.json and review the middleware code, which should be small and focused. Test the redirect behavior in staging, especially behind proxies and with excluded routes. As with any package, monitor updates and run your normal security review.