28 lines
822 B
PHP
28 lines
822 B
PHP
<?php
|
|
|
|
namespace App\Http\Middleware;
|
|
|
|
use Closure;
|
|
use Illuminate\Http\Request;
|
|
use Symfony\Component\HttpFoundation\Response;
|
|
|
|
class SecurityHeaders
|
|
{
|
|
/**
|
|
* Handle an incoming request.
|
|
*/
|
|
public function handle(Request $request, Closure $next): Response
|
|
{
|
|
$response = $next($request);
|
|
|
|
// Ajouter les headers de sécurité
|
|
$response->headers->set('Strict-Transport-Security', 'max-age=31536000; includeSubDomains', true);
|
|
$response->headers->set('X-Content-Type-Options', 'nosniff', true);
|
|
$response->headers->set('X-Frame-Options', 'SAMEORIGIN', true);
|
|
$response->headers->set('X-XSS-Protection', '1; mode=block', true);
|
|
$response->headers->set('Referrer-Policy', 'strict-origin-when-cross-origin', true);
|
|
|
|
return $response;
|
|
}
|
|
}
|