47 lines
1.5 KiB
PHP
47 lines
1.5 KiB
PHP
<?php
|
|
|
|
namespace App\Http\Middleware;
|
|
|
|
use Closure;
|
|
use Illuminate\Http\Request;
|
|
use Symfony\Component\HttpFoundation\Response;
|
|
|
|
class SecurityHeaders
|
|
{
|
|
/**
|
|
* Handle an incoming request and add security headers.
|
|
*
|
|
* @param \Closure(\Illuminate\Http\Request): (\Symfony\Component\HttpFoundation\Response) $next
|
|
*/
|
|
public function handle(Request $request, Closure $next): Response
|
|
{
|
|
$response = $next($request);
|
|
|
|
// Prevenir ataques XSS
|
|
$response->headers->set('X-XSS-Protection', '1; mode=block');
|
|
|
|
// Prevenir MIME type sniffing
|
|
$response->headers->set('X-Content-Type-Options', 'nosniff');
|
|
|
|
// Prevenir clickjacking
|
|
$response->headers->set('X-Frame-Options', 'DENY');
|
|
|
|
// Política de referrer
|
|
$response->headers->set('Referrer-Policy', 'strict-origin-when-cross-origin');
|
|
|
|
// Remover headers que expõem informações do servidor
|
|
$response->headers->remove('X-Powered-By');
|
|
$response->headers->remove('Server');
|
|
|
|
// Content Security Policy (CSP) - apenas para API
|
|
if ($request->is('api/*')) {
|
|
$response->headers->set('Content-Security-Policy', "default-src 'none'; frame-ancestors 'none'");
|
|
}
|
|
|
|
// Permissions Policy (anteriormente Feature-Policy)
|
|
$response->headers->set('Permissions-Policy', 'geolocation=(), microphone=(), camera=()');
|
|
|
|
return $response;
|
|
}
|
|
}
|