Middleware to redirect to https
if the request is http
and add the Strict Transport Security header to protect against protocol downgrade attacks and cookie hijacking.
- PHP >= 7.0
- A PSR-7 http library
- A PSR-15 middleware dispatcher
This package is installable and autoloadable via Composer as middlewares/https.
composer require middlewares/https
$dispatcher = new Dispatcher([
(new Middlewares\Https())
->includeSubdomains()
]);
$response = $dispatcher->dispatch(new ServerRequest());
max-age
directive for the Strict-Transport-Security
header. By default is 31536000
(1 year).
Set true
to add the includeSubDomains
directive to the Strict-Transport-Security
header (false
by default)
Set true
to add the preload
directive to the Strict-Transport-Security
header (false
by default)
If it's true
and the request contains the headers X-Forwarded-Proto: https
or X-Forwarded-Port: 443
, no redirection is returned. This prevent problems with Https load balancer.
Enabled (true
) or disable (false
) redirecting all together.
A PSR-17 factory to create the redirect response.
Please see CHANGELOG for more information about recent changes and CONTRIBUTING for contributing details.
The MIT License (MIT). Please see LICENSE for more information.