sam
ebe1836f7e
- middleware SecurityHeaders (HSTS, CSP, X-Frame-Options, etc.) - trustProxies pour le reverse proxy Nginx Proxy Manager - .env.production.example (APP_DEBUG=false, sessions chiffrees, cookies Secure) - politique de securite SECURITY.md Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
27 lines
992 B
PHP
27 lines
992 B
PHP
<?php
|
|
|
|
use App\Http\Middleware\SecurityHeaders;
|
|
use Illuminate\Foundation\Application;
|
|
use Illuminate\Foundation\Configuration\Exceptions;
|
|
use Illuminate\Foundation\Configuration\Middleware;
|
|
|
|
return Application::configure(basePath: dirname(__DIR__))
|
|
->withRouting(
|
|
web: __DIR__.'/../routes/web.php',
|
|
api: __DIR__.'/../routes/api.php',
|
|
commands: __DIR__.'/../routes/console.php',
|
|
health: '/up',
|
|
)
|
|
->withMiddleware(function (Middleware $middleware): void {
|
|
// L'application est servie derrière un reverse proxy (Nginx Proxy Manager)
|
|
// qui termine le TLS : on lui fait confiance pour détecter HTTPS,
|
|
// l'IP réelle du client et le bon schéma d'URL.
|
|
$middleware->trustProxies(at: '*');
|
|
|
|
// En-têtes de sécurité HTTP appliqués à toutes les réponses.
|
|
$middleware->append(SecurityHeaders::class);
|
|
})
|
|
->withExceptions(function (Exceptions $exceptions): void {
|
|
//
|
|
})->create();
|