Class HttpsEnforcerMiddleware
Enforces use of HTTPS (SSL) for requests.
Property Summary
-
$config protected
array<string, mixed>Configuration.
Method Summary
-
__construct() public
Constructor
-
addHsts() protected
Adds Strict-Transport-Security header to response.
-
process() public
Check whether request has been made using HTTPS.
Method Detail
__construct() ¶ public
__construct(array<string, mixed> $config = [])Constructor
Parameters
-
array<string, mixed>$config optional The options to use.
See Also
addHsts() ¶ protected
addHsts(Psr\Http\Message\ResponseInterface $response): Psr\Http\Message\ResponseInterfaceAdds Strict-Transport-Security header to response.
Parameters
-
Psr\Http\Message\ResponseInterface$response Response
Returns
Psr\Http\Message\ResponseInterfaceprocess() ¶ public
process(ServerRequestInterface $request, RequestHandlerInterface $handler): Psr\Http\Message\ResponseInterfaceCheck whether request has been made using HTTPS.
Depending on the configuration and request method, either redirects to same URL with https or throws an exception.
Parameters
-
ServerRequestInterface$request The request.
-
RequestHandlerInterface$handler The request handler.
Returns
Psr\Http\Message\ResponseInterfaceThrows
Cake\Http\Exception\BadRequestExceptionProperty Detail
$config ¶ protected
Configuration.
Options
-
redirect- If set to true (default) redirects GET requests to same URL with https. -
statusCode- Status code to use in case of redirect, defaults to 301 - Permanent redirect. -
headers- Array of response headers in case of redirect. -
disableOnDebug- Whether HTTPS check should be disabled when debug is on. Defaulttrue. -
trustedProxies- Array of trusted proxies that will be passed to the request. Defaults tonull. -
'hsts' - Strict-Transport-Security header for HTTPS response configuration. Defaults to
null. If enabled, an array of config options: -
'maxAge' -
max-agedirective value in seconds.- 'includeSubDomains' - Whether to include
includeSubDomainsdirective. Defaults tofalse. - 'preload' - Whether to include 'preload' directive. Defauls to
false.
- 'includeSubDomains' - Whether to include
Type
array<string, mixed>