diff --git a/CHANGELOG.md b/CHANGELOG.md index dd5f62c..51ba4a3 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,10 @@ All Notable changes to `laravel-https` will be documented in this file +## 1.1.0 - 2018-08-17 + +- ADD support for X-Forwarded-Proto request header. + ## 1.0.3 - 2018-05-09 - Fix publish config path for unix (case sensitive) diff --git a/README.md b/README.md index 985087c..5e2d745 100644 --- a/README.md +++ b/README.md @@ -84,7 +84,7 @@ You can include the HttpsForce in a route groups or on individual routes. ### From Controller File: -You can include the HttpsForce in the contructor of your controller file. +You can include the HttpsForce in the constructor of your controller file. ### Controller File Example: diff --git a/src/Middleware/HttpsForceMiddleware.php b/src/Middleware/HttpsForceMiddleware.php index c4efcf7..eb5e7d1 100644 --- a/src/Middleware/HttpsForceMiddleware.php +++ b/src/Middleware/HttpsForceMiddleware.php @@ -16,7 +16,7 @@ class HttpsForceMiddleware */ public function handle(Request $request, Closure $next) { - if ($request->secure()) { + if ($this->isSecureRequest($request)) { return $next($request); } @@ -30,4 +30,14 @@ public function handle(Request $request, Closure $next) return $next($request); } + + /** + * @param Request $request + * @return mixed + */ + public function isSecureRequest(Request $request) + { + $xForwardedProto = strtolower($request->header('X_FORWARDED_PROTO', '')); + return ($request->secure() || $xForwardedProto=='https'); + } } diff --git a/tests/LaravelHttpsTest.php b/tests/LaravelHttpsTest.php index 1cabc0e..dd80e35 100644 --- a/tests/LaravelHttpsTest.php +++ b/tests/LaravelHttpsTest.php @@ -58,6 +58,23 @@ public function testalways_force_httpsTrue() $response->assertRedirect(secure_url('/')); } + /** @test */ + public function testIsSecureRequest_no_x_proto() + { + config(['laravel-https.always_force_https' => true]); + $response = $this->get('/'); + $response->assertStatus(301); + $response->assertRedirect(secure_url('/')); + } + + /** @test */ + public function testIsSecureRequest_yes_x_proto() + { + config(['laravel-https.always_force_https' => true]); + $response = $this->get('/', ['X-Forwarded-Proto' => 'https']); + $response->assertStatus(200); + } + /** @test */ public function testEnviromentNotInArray() {