Introduction

Once you have an SSL certificate configured, the next step is to redirect unencrypted traffic. There are several methods of doing this. Within your application (Laravel), by the web server (Apache or Nginx) or by the frontend (load balancer). This article will redirect HTTP requests to HTTPS in Laravel using middleware.

If you are also deploying a frontend load balancer, configure both HTTP and HTTPS frontends. In most cases, you will forward traffic from the load balancer to the backend (Laravel) via HTTP and not by HTTPS. This is called SSL Offloading. This means your Laravel middleware must detect the protocol (HTTP or HTTPS) that the client connected to the load balancer and ignore the protocol that the load balancer is using to connect to the backend. Otherwise, the middleware will detect HTTP even if the client connected to the load balancer using HTTPS, and the client will go into a redirect loop.

In this article, I will use yourdomain.com. Replace with your domain name.

Laravel middleware only supports files served by routes. Files that are not served by Laravel, such as /js/app.js will NOT be redirected. This is one of the reasons I like to have HTTP Redirection as several layers (load balancer, web server, application framework). Another reason is to ensure that more than one service layer enforces HTTP Redirection.

Configure .env

This article supports two environments, development and production. The development settings will not redirect HTTP to HTTPS. The production environment will redirect. The environment will be detected by the APP_ENV setting.

Production Configuration:

• APP_ENV=production
• APP_DEBUG=false
• APP_URL=https://yourdomain.com

Development Configuration:

• APP_ENV=local
• APP_DEBUG=true
• APP_URL=http://localhost:8000

The application environment labels local and production are used to enable/disable certain features in Laravel.

Initial Testing

Open a web browser and connect to your site via HTTP: http://yourdomain.com. Verify that your site loads correctly, and you are not redirected to HTTPS. Note: some TLD domains such as .dev automatically redirect in browsers. If this is the case for you, use the curl command method below.

Open a command prompt and run this command:

We are interested in the first part of the output which is the HTTP status code. If HTTP redirection is disabled, you should receive a 200 response:

For this article, we want a 200 response so that we can implement and test HTTP redirection.

If HTTP redirection is enabled, then you will receive a 3xx response with an HTTP Location header:

Before continuing, disable redirects in your web server or frontend (load balancer). Save your changes, so that you can reenable redirection at the frontend or at the webserver.

Note: browsers tend to cache HTTP redirects. You might need to disable the browser cache.

Disable Chrome Cache

• Open the Chrome Developer Tools (F12).
• Go to the Network tab and make sure Disable cache is ticked.
• Keep the Developer Tools open while testing.

Create the Middleware

Using artisan create the middleware template:

This creates the file app/Http/Middleware/HttpRedirect.php.

Near the top of the file add:

Modify the function handle(). Note the following features:

• Check if the request is using HTTP: !$request->secure()
• Check if the environment is production: App::environment('production')
• If both requirements are met, redirect the client to the same URI using HTTPS. Otherwise, proceed to the next handler.

The above redirect will return the HTTP code 302. For permanent HTTP to HTTPS redirects, return HTTP code 301 (permanent redirect):

If you have development, staging and production environments and you want HTTP redirection for both staging and production:

Edit App/Http/Kernel.php and add the middleware to $middleware:

Clear the configuration:

Supporting Proxy Frontends

If you are using a load balancer that connects to your Laravel backend using HTTP, detect the HTTP header X-Forwarded-Proto. Use this code for the handle() function instead:

Warning

If your Laravel application does not have a proxy (load balancer) accepting traffic, do not add the proxy code. A smart hacker could manually add the header X-Forwarded-Proto and bypass the HTTP Redirect feature.

If you allow your Laravel backend to be accessed from a load balancer and directly from the Internet, add logic to only process the X-Forwarded-Proto header if the request arrives from a known frontend. Google Cloud HTTP(S) Load Balancers use the 130.211.0.0/22 and 35.191.0.0/16 IP address ranges.

Additional Options

The above middleware will redirect requests that are handled by Laravel routes. I also recommend that Laravel always generate content using HTTPS based URLs. Examples are JavaScript and CSS references.

Edit app/Providers/AppServiceProvider.php

Near the top add:

Add the following code to the boot function:

Summary

I prefer to implement multiple layers of security. When implementing HTTP Redirection, I try to implement this feature at each service layer. Starting with the backend (Laravel), then with the web server (Apache or Nginx), and finally at the load balancer. Sometimes mistakes are made, and one layer might disable HTTP Redirection. By enabling this feature in more than one service, I have a higher confidence level that clients’ data is and remains encrypted.

Photography Credits

I write free articles about technology. Recently, I learned about Pexels.com which provides free images. The image in this article is courtesy of Pixabay at Pexels.

Related Posts

The second season of Netflix’s The Witcher brings a lot of good material with it, from the growing relationship between Geralt (Henry Cavill) and Ciri (Freya Allan) to Yennefer (Anya Chalotra) growing into her magical power. For Geralt and Ciri in particular, a lot of their relationship is rooted in him training her to become a Witcher at Kaer Morhen, a key location in the books and Geralt’s childhood home.

Netflix has been releasing a series of videos going into the development of Witcher’s sophomore season, and two specifically are focused on the remaining Witchers and Ciri’s character development. After spending the first season running from threat after threat, Allan was excited for Ciri to both “navigate what she wants,” and to finally be involved in the action.

“It’s very difficult to go straight into swordfighting routines,” Allan recalled. “So I had to do quite a bit of training.” When it came time to do actual stunt work, showrunner Lauren Schmidt Hissrich had glowing praise for Allan’s dedication, particularly when it came to the obstacle course at Kaer Morhen. “She couldn’t have loved it more…Watching Freya get knocked physically off of it so many times was pretty incredible and terrifying.”

Though Ciri wants to follow in the footsteps of her surrogate father, he’s not the only Witcher she spends time with throughout the season. Below, the second video shines a spotlight on the other Witchers: Eskel (Basil Eidenbenz), Coen (Yasen Atour), and Lambert (Paul Bullion). All three are fan favorites from the books and games, but they’re all arguably outclassed in terms of importance by Kim Bodnia’s Vesemir, Geralt’s own father figure who starred in the animated prequel Nightmare of the Wolf. Vesemir has been leading the remaining Witchers since the events of the film, and Allan says that over the course of the season, Ciri comes to respect him as much as Geralt does.

Every winter, the remaining Witchers go to Kaer Morhen because it’s where they “feel rooted as a family,” in the words of Paul Billion, who plays Lambert, . The scarcity of their ranks have only made their bonds with each other grow stronger, something you see throughout the season as they help train Ciri and fight monsters together. “It’s about family and exploring what family means,” Bullion continued. “It’s what the Witchers represent.”

The family bond is something fans have wanted to see in the show for some time, but the new season has thrown a curve ball that not all are happy with, and have left fans demanding answers.

When Geralt and Ciri arrive at Kaer Morhen in the second episode, the reunion turns grim when it’s revealed that Eskel was infected by a leshen while hunting it down. He’s then killed by Geralt, something that very much doesn’t happen in the books. Speaking on the show’s podcast on YouTube, Schmidt Hissrich discussed how the process of Eskel’s grim fate came to be. They’d known how they always wanted to kill someone, and it was important to make sure it had something to do with Ciri. Regardless of who died, that death had to to force Geralt and the other Witchers to realize her presence here would change things.

Originally, that death was going to be for a brand new character she called “John.” But that death wouldn’t have mattered, so it was changed to Eskel as to really have an affect on Geralt and spur him to truly train Ciri. “I know that there are fans who love Eskel and who feel like, why would we do that?…But honestly, his death is what changes everything for Geralt.” Part of the desire to kill off Eskel and more Witchers was also to drive home the idea of the Witchers being caught up in a constantly changing world. “So much of season two is about the fact of, ‘Is the Witcher brotherhood over?’…Of course we had to kill more.”

Despite how bleak things are for the organization, Schmidt Hissrich believes that Vesemir still has some hope for the future. “There’s this history in Vesemir, he’s the keeper of Witcher history…When Ciri and Vesemir are walking through the Kaer Morhen lab, we hear his retelling of the deaths of the Witchers, and suddenly why he thinks Ciri could be their savior. It’s that type of optimism that’s really important to Vesemir.”

The Witcher season two is out now on Netflix.

A while back, I PR’d a LazilyRefreshDatabase trait to the Laravel Framework. This came from the annoyance of having to manually include RefreshDatabase in each test, unless you wanted to suffer a performance penalty. It was very well received. So well, in fact, that it almost became the default way of refreshing your test database in new Laravel projects. Almost, until it was revealed there was a catch.

For most projects, LazilyRefreshDatabase would work without issue. I had several projects that were updated and running in less than 5 minutes. But on other projects, that wasn’t quite the case.

As an example, take the TestCase from the in-progress PestPHP news site: https://github.com/pestphp/news.pestphp.com/blob/main/tests/TestCase.php. We have a non-standard migration strategy here: before each test, we need to ask Laravel to also migrate Wink’s migration files, then run a seeder.

This would cause a real problem for LazilyRefreshDatabase. Why? Basically, if we did it in the setUp method, we would be completely negating any benefits provided by the LazilyRefreshDatabase trait, because the database would go back to being refreshed after every test. What if instead we use a listener that fires after database migration is complete, like so?

public function setUp()
{
  parent::setUp();
 
  Event::listen(MigrationsEnded::class, function () {
    $this->artisan('migrate', [
      '--path' => 'vendor/themsaid/wink/src/Migrations',
    ]);
  });
}

Well, this seems like a good idea, until you run it. What we’ve actually caused here is an endless loop, because the Wink artisan command will cause the MigrationsEnded event to fire again. Not good. Not good at all.

What we actually need is a hook. A hook that will fire after the database has refreshed. A hook that doesn’t care whether you’re using RefreshDatabase or LazilyRefreshDatabase, but rather just works.

That’s exactly what the new afterRefreshingDatabase method does. It will fire once the database has been refreshed (as the name implies), and gives you the perfect location to drop any test setup code like this. By using this method, we keep all of the benefits of lazily refreshing our database whilst allowing for pretty much any database setup, whether that’s additional migrations, seeding or something else, that is required.

public function afterRefreshingDatabase()
{
  $this->artisan('migrate', [
    '--path' => 'vendor/themsaid/wink/src/Migrations',
  ]);
}

I have to give a shoutout to Aaron Francis here, who inspired me to write this PR after this conversation on Twitter: https://twitter.com/aarondfrancis/status/1469331525422489604?s=20.

So, now you know why and how to use afterRefreshingDatabase in your Laravel tests. Since adding this method to the Laravel Framework, I’ve been able to adopt LazilyRefreshDatabase in all of my projects without any issues!

Kind Regards,

Luke

BETHLEHEM—According to sources, the eternal Word of God has become flesh in the form of a newborn baby who was born this morning.

Some claim that this child is the human incarnation of the God of the Universe, who has come to reconcile a broken creation with its holy Creator, saving a wayward human race in a heroic rescue echoed in myths, legends, prophecies, and whispered hopes since the dawn of time. 

If true, then God is with us, and things will never be the same again.

Remington Ammunition

Prices accurate at time of writing