Ensuring Secure URLs in Laravel Applications

Laravel's forceHttps method provides a straightforward way to enforce HTTPS for all generated URLs in your application. This feature ensures that your links, redirects, and assets always use secure connections in production environments.

This approach is particularly valuable for applications handling sensitive data, as it helps prevent mixed content warnings and ensures a consistent security posture across your entire site.

// Simple production-only enforcement
URL::forceHttps($app->isProduction());
 
// More granular environment control
URL::forceHttps(
    $app->environment(['production', 'staging'])
);

Here's an example of implementing comprehensive security enhancements:

<?php
 
namespace App\Providers;
 
use Illuminate\Support\Facades\URL;
use Illuminate\Support\ServiceProvider;
 
class AppServiceProvider extends ServiceProvider
{
    public function boot()
    {
        $this->configureSecureUrls();
    }
 
    protected function configureSecureUrls()
    {
        // Determine if HTTPS should be enforced
        $enforceHttps = $this->app->environment(['production', 'staging'])
            && !$this->app->runningUnitTests();
 
        // Force HTTPS for all generated URLs
        URL::forceHttps($enforceHttps);
 
        // Ensure proper server variable is set
        if ($enforceHttps) {
            $this->app['request']->server->set('HTTPS', 'on');
        }
 
        // Set up global middleware for security headers
        if ($enforceHttps) {
            $this->app['router']->pushMiddlewareToGroup('web', function ($request, $next){
                $response = $next($request);
 
                return $response->withHeaders([
                    'Strict-Transport-Security' => 'max-age=31536000; includeSubDomains',
                    'Content-Security-Policy' => "upgrade-insecure-requests",
                    'X-Content-Type-Options' => 'nosniff'
                ]);
            });
        }
    }
}