Really force http to https in Laravel - php

I have this Laravel App which I'm deplying to Heroku.
I have followed all of the steps until I encountered a problem relating some assets (asset('css/app.css'), for example) refering to http urls, instead of https urls.
I solved that by adding
if(config('app.env')==='production'){
\URL::forceScheme('https');
}
in the boot method of my AppServiceProvider.php file, and it worked.
But now I have encountered another http related problem that the previous code couldn't solve.
I am fetching my data using simplePaginate() function like so
public function index(Question $question){
$answers = $question->answers()->with('user');
return $answers->simplePaginate(3);
}
This code returns me a response with my 3 answers, as well as with a property called 'next_page_url'
which is, still, plain http (not https as i need it to be).
What can I do for this to be https as Heroku requires?

Heroku's load balancing setup means the indication of whether the request is HTTP or HTTPS comes from the X-Forwarded-Proto header. (Laravel also needs the X-Forwarded-For header to get the users' real IP addresses, incidentally.)
By default, Laravel doesn't trust these headers (as in a different setup it might come from a malicious client), so none of the requests will be detected as HTTPS. You can fix this by configuring the Laravel trusted proxy to trust the header.
In the default config, just setting $proxies = '*', will do the trick, and is safe on Heroku because the load balancers can't be bypassed by end users.

The correct way is to change the URL of your app to https://example.com in the configuration file (.env file as an example). Just write APP_URL=https://example.com
But, when you use Heroku - their balancers can route your requests to https://yourDomain.com to your application over HTTP. So, the Laravel app receives the request to http://yourDomain.com and decides that you need a response with HTTP links.
As #seejayoz said you need to configure trusted proxies list for your app.

I think you can use withPath (or setPath alias) :
$pagi=$answers->simplePaginate(3);
$pagi->withPath("https://link/xxx/");
return $pagi;

Related

access to xmlhttprequest has been blocked by cors policy no 'access-control-allow-origin' [duplicate]

I am working on an app using Vue js.
According to my setting I need to pass to a variable to my URL when setting change.
<!-- language: lang-js -->
$.get('http://172.16.1.157:8002/firstcolumn/' + c1v + '/' + c1b, function (data) {
// some code...
});
But when my app hit on URL, it shows the following message.
Failed to load http://172.16.1.157:8002/firstcolumn/2017-03-01/2017-10-26: Redirect from 'http://172.16.1.157:8002/firstcolumn/2017-03-01/2017-10-26' to 'http://172.16.1.157:8002/firstcolumn/2017-03-01/2017-10-26/' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://localhost:8080' is therefore not allowed access.
In addition to what awd mentioned about getting the person responsible for the server to reconfigure (an impractical solution for local development) I use a change-origin chrome plugin like this:
Moesif Orign & CORS Changer (use to be free but now wants a work email address >_>)
Allow CORS: Access-Control-Allow-Origin
You can make your local dev server (ex: localhost:8080) to appear to be coming from 172.16.1.157:8002 or any other domain.
In case the 2nd plugin link breaks in the future or the plugin writer decides to capitalize off the fame of this thread, open your browser's
plugin marketplace and search "allow cors", there's going to be a
bunch of them.
Thanks all, I solved by this extension on chrome.
Allow CORS: Access-Control-Allow-Origin
If you have control over your server, you can use PHP:
<?PHP
header('Access-Control-Allow-Origin: *');
?>
Ask the person maintaining the server at http://172.16.1.157:8002/ to add your hostname to Access-Control-Allow-Origin hosts, the server should return a header similar to the following with the response-
Access-Control-Allow-Origin: yourhostname:port
Using npm:
To allow cross-origin requests install 'cors':
npm i cors
Add this in the server-side:
let cors = require("cors");
app.use(cors());
When you have this problem with Chrome, you don't need an Extension.
Start Chrome from the Console:
chrome.exe --user-data-dir="C:/Chrome dev session" --disable-web-security
Maybe you have to close all Tabs in Chrome and restart it.
I will assume that you're a front-end developer only and that you don't have access to the backend of the application (regarding the tags of the question).
Short answer on how to properly solve this in your case? You can't, you'll need somebody else.
What is this about?
You need to understand that CORS is a security thing, it's not just here to annoy you just for fun.
It's purpose is to mainly prevent the usage of a (malicious) HTTP call from a non-whitelisted frontend to your backend with some critical mutation.
You could give a look to this YouTube video or any other one really, but I recommend a visual video because text-based explanation can be quite hard to understand.
You also need to understand that if you use Postman or any other tool to try your API call, you will not get the CORS issue. The reason being that those tools are not Web frontends but rather some server-based tools.
Hence, don't be surprised if something is working there but not in your Vue app, the context is different.
Now, how to solve this?
Depending of the framework used by your backend team, the syntax may be quite different but overall, you'll need to tell them to provide something like Access-Control-Allow-Origin: http://localhost:3000 (or any other port you'll be using).
PS: Using Access-Control-Allow-Origin: * would be quite risky because it would allow anybody to access it, hence why a stricter rule is recommended.
If you're using a service, like an API to send SMS, payment, some Google console or something else really, you'll need to allow your localhost in the dashboard of the service. Ask for credentials to your manager or Tech Lead.
If you have access to the backend, you could it yourself as shown here (ExpressJS in this example): https://flaviocopes.com/cors/
How to hack it in a dirty way?
If you're in a damn hurry and want to get something really dirty, you could use a lot of various hacks a listed in the other answers, here's a quick list:
use any extension who is able to create a middleware and forward the request to the backend (it will work because it's not directly coming from your frontend)
force your browser to disable CORS, not sure how this would actually solve the issue
use a proxy, if you're using Nuxt2, #nuxtjs/proxy is a popular one but any kind of proxy (even a real backend will do the job)
any other hack related somehow to the 3 listed above...
At the end, solving the CORS issue can be done quite fast and easily. You only need to communicate with your team or find something on your side (if you have access to the backend/admin dashboard of some service).
I heavily do recommend trying get it right from the beginning because it's related to security and that it may be forgotten down the road...
The approved answer to this question is not valid.
You need to set headers on your server-side code
app.use((req,res,next)=>{
res.setHeader('Access-Control-Allow-Origin','*');
res.setHeader('Access-Control-Allow-Methods','GET,POST,PUT,PATCH,DELETE');
res.setHeader('Access-Control-Allow-Methods','Content-Type','Authorization');
next();
})
You can also try a chrome extension to add these headers automatically.
Hello If I understood it right you are doing an XMLHttpRequest to a different domain than your page is on. So the browser is blocking it as it usually allows a request in the same origin for security reasons. You need to do something different when you want to do a cross-domain request. A tutorial about how to achieve that is Using CORS.
When you are using postman they are not restricted by this policy. Quoted from Cross-Origin XMLHttpRequest:
Regular web pages can use the XMLHttpRequest object to send and receive data from remote servers, but they're limited by the same origin policy. Extensions aren't so limited. An extension can talk to remote servers outside of its origin, as long as it first requests cross-origin permissions.
To add the CORS authorization to the header using Apache, simply add the following line inside either the <Directory>, <Location>, <Files> or <VirtualHost> sections of your server config (usually located in a *.conf file, such as httpd.conf or apache.conf), or within a .htaccess file:
Header set Access-Control-Allow-Origin "*"
And then restart apache.
Altering headers requires the use of mod_headers. Mod_headers is enabled by default in Apache, however, you may want to ensure it's enabled.
I had the same problem in my Vue.js and SpringBoot projects. If somebody work with spring you can add this code:
#Bean
public FilterRegistrationBean simpleCorsFilter() {
UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
CorsConfiguration config = new CorsConfiguration();
config.setAllowCredentials(true);
// *** URL below needs to match the Vue client URL and port ***
config.setAllowedOrigins(Collections.singletonList("http://localhost:8080"));
config.setAllowedMethods(Collections.singletonList("*"));
config.setAllowedHeaders(Collections.singletonList("*"));
source.registerCorsConfiguration("/**", config);
FilterRegistrationBean bean = new FilterRegistrationBean<>(new CorsFilter(source));
bean.setOrder(Ordered.HIGHEST_PRECEDENCE);
return bean;
}
I found solution in this article Build a Simple CRUD App with Spring Boot and Vue.js
You are making a request to external domain 172.16.1.157:8002/ from your local development server that is why it is giving cross origin exception.
Either you have to allow headers Access-Control-Allow-Origin:* in both frontend and backend or alternatively use this extension cors header toggle - chrome extension unless you host backend and frontend on the same domain.
Try running this command in your terminal and then test it again.
curl -H "origin: originHost" -v "RequestedResource"
Eg:
If my originHost equals https://localhost:8081/ and my RequestedResource equals https://example.com/
My command would be as below:
curl -H "origin: https://localhost:8081/" -v "https://example.com/"
If you can notice the following line then it should work for you.
< access-control-allow-origin: *
Hope this helps.
Do specify #CrossOrigin(origins = "http://localhost:8081")
in Controller class.
You can solve this temporarily by using the Firefox add-on, CORS Everywhere. Just open Firefox, press Ctrl+Shift+A , search the add-on and add it!
You won't believe this,
Make sure to add "." at the end of the "url"
I got a similar error with this code:
fetch(https://itunes.apple.com/search?term=jack+johnson)
.then( response => {
return response.json();
})
.then(data => {
console.log(data.results);
}).catch(error => console.log('Request failed:', error))
The error I got:
Access to fetch at 'https://itunes.apple.com/search?term=jack+johnson'
from origin 'http://127.0.0.1:5500' has been blocked by CORS policy:
No 'Access-Control-Allow-Origin' header is present on the requested
resource. If an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled.
But I realized after a lot of research that the problem was that I did not copy the
right URL address from the iTunes API documentation.
It should have been
https://itunes.apple.com/search?term=jack+johnson.
not
https://itunes.apple.com/search?term=jack+johnson
Notice the dot at the end
There is a huge explanation about why the dot is important quoting issues about DNS and character encoding but the truth is you probably do not care. Try adding the dot it might work for you too.
When I added the "." everything worked like a charm.
I hope it works for you too.
install:
npm i cors
Then include cors():
app.get("/list",cors(),(req,res) =>{
});
In addition to the Berke Kaan Cetinkaya's answer.
If you have control over your server, you can do the following in ExpressJs:
app.use(function(req, res, next) {
// update to match the domain you will make the request from
res.header("Access-Control-Allow-Origin", "YOUR-DOMAIN.TLD");
res.header("Access-Control-Allow-Methods", "GET,HEAD,OPTIONS,POST,PUT");
res.header("Access-Control-Allow-Headers", "Origin, X-Requested-With, Content-Type, Accept");
next();
});
https://enable-cors.org/server_expressjs.html
I tried this code,and that works for me.You can see the documentation in this link
var io = require("socket.io")(http, {
cors: {
origin: "*",
methods: ["GET", "POST"]
}
})
The reason that I came across this error was that I hadn't updated the path for different environments.
you have to customize security for your browser or allow permission through customizing security. (it is impractical for your local testing)
to know more about please go through the link.
https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS
These errors may be caused due to follow reasons, ensure the following steps are followed. To connect the local host with the local virtual machine(host). Here, I'am connecting http://localhost:3001/ to the http://abc.test Steps to be followed:
1.We have to allow CORS, placing Access-Control-Allow-Origin: in header of request
may not work. Install a google extension which enables a CORS request.*
2.Make sure the credentials you provide in the request are valid.
3.Make sure the vagrant has been provisioned. Try vagrant up --provision this make the localhost connect to db of the homestead.
Try changing the content type of the header. header:{ 'Content-Type' : 'application/x-www-form-urlencoded; charset=UTF-8;application/json' }
this point is very important.
Another solution to this problem in a specific scenario :
If
AWS APIGW is your backend with authentication enabled and
authentication fails,
your browser may end up complaining about CORS even if CORS is enabled in APIGW. You also need to enable CORS for 4XX as follows
API:YourAPI > Resources > /YourResource > Actions > Enable CORS > Gateway Responses for yourAPI check Default 4XX
Authentication will still fail but it won't look like CORS is the root cause
$.get('https://172.16.1.157:8002/firstcolumn/' + c1v + '/' + c1b, function (data) {
// some code...
});
Just put "https" .

Laravel Signed Routes throws InvalidSignatureException in production

Whenever I use visit a URL created with temporarySignedRoute() on production, it throws InvalidSignatureException. However, when in dev environment, it works. I have also tried using signedRoute() with no luck.
I am creating my URLs like this:
\URL::temporarySignedRoute(
'user.activate',
now()->addHours(200),
[ 'id' => $user->id ]
);
Example of URL: https://xx.xx/activate/5?expires=1537065074&signature=f57713b2fccea5ce17b7c1a3241e275d62f1994cd8004ea480cced2402081090
I have made sure that the APP_KEY is set. I'm not really sure what step I should take in order to fix this. I am using Laravel Forge for deployment. I am also using a Load Balancer but only one app server atm.
Why is temporarySignedRoute() throwing InvalidSignatureException in production?
Edit:
Logging the request, I get this data:
// [ $expired, $url, $query, $original, $signature ]
[
false,
"http://xx.xx/activate/13",{"expires":"1537076308","signature":"9d972a574137bf7e5f30120c3f539a81bca71875020c3476e3bfb230220a73f7"},
"http://xx.xx/activate/13?expires=1537076308",
"ed80a6ae717e806fd5f887224c2ac88f5fffb893ae284cc52688ba0690d3a9e1"
]
Notice that the URL starts with http:// but the actual link generated is using https://. The URL is logged with request()->url(). Which leads me to believe that the problem lies in the http-scheme.
In my AppServiceProvider.php I am forcing https like this:
if (env('APP_ENV') == 'production') {
\URL::forceScheme('https');
}
Why is request() receiving it as non-http?
This was caused by my load balancer not sending HTTPS calls to the server. Meaning the server was hashing a different URL-scheme (http) than the original (https).
I ran into the same issue and Fredrik's answer helped.
When I dumped the request while generating the signed url, I saw that my server was requesting from "http" rather than "https" even though the site was served over "https". I had to change my Cloudflare settings to force https on requests...

Route with dot (IP address) not found, returns 404

I use Lumen 5.4.
This is how my route is setup:
$app->get('/ip/{ip}', GeoIpController::class . '#show');
The {ip} route parameter should be an IP address, with dots in it. However, it seems there is a problem when a route has dots in it. It returns a 404 not found error.
I am aware I could pass the IP address in as a simple GET request parameter, but want the IP to be part of the URL and to be handled like a route parameter.
For testing purposes, I use php -S localhost:8080 -t public to serve the application.
This is a limitation on PHP's built in server, not with Lumen (or Laravel, or Slim, or any other frameworks/apps with a router). You can view the PHP bug report here.
Basically, if the URL has a dot in the url after the script name, the built-in server treats the request as a static file request, and it never actually attempts to run through the application.
This request should work fine on a real web server (apache, nginx), but it will fail when run on PHP's built-in development web server.

Laravel configurate force https

Our website is hosted on a load balanced server. SSL offloading is done on the firewall, so the client is reverse proxied to the web server farm.
When the https request reaches our Laravel app, the server variable HTTPS is empty and Laravel doesn't seem to detect the https mode and generates urls (assets & routes) as:
http://www.somesite.be:443/assets/
http://www.somesite.be:443/nl-BE/about
Is there a way to configure Laravel to force the url's to generate https links?
We prefer to have a configuration solution because we have a development and staging environment that aren't running under https.
Notice:
We already tried the "trustedproxy" approach from fideloper, and this resulted in no change.
I presume that a .htaccess rewrite is not an option since htaccess rewrites are based on the same https header (we don't receive) or port (80, laravel calls port 443).
Thanks for the help.
Laravel's UrlGenerator class has a method called forceSchema, which allows you to force the schema to be used and ignore the one extracted from the request's URL. Just create a service provider SecureRoutingServiceProvider which uses Laravel's IOC to override the default generator and return an instance that forces the secure schema:
use Illuminate\Routing\UrlGenerator;
use Illuminate\Routing\RoutingServiceProvider;
class SecureRoutingServiceProvider extends RoutingServiceProvider
{
public function boot()
{
App::bind('url', function () {
$generator = new UrlGenerator(
App::make('router')->getRoutes(),
App::make('request');
});
$generator->forceSchema('https');
return $generator;
}
parent::boot();
}
}
Next we'll need to register the service provider by adding it to the providers array in app/config/app.php:
'providers' => array(
...,
'SecureRoutingServiceProvider',
)
And that's all there is to it. I've tested this code and it works fine (in Laravel 4.2).
Working on the same issue with Laravel 5 Pagination Feature. For that its not enough to just force the URL Schema in the Generator, because its using the URL associated with the Request. After digging i found a good fix.
Illuminate\Http\Request has a trustedProxies Array that is basically for this case.
I still used the SecureRoutingServiceProvider from Bogdan as a starting point to whitelist our Load Balancer.
public function boot()
{
Request::setTrustedProxies(['10.0.0.X']); // Here should be your internal LB IP
parent::boot();
}
After that it worked pretty well. Of course you should put the IP in a config/env file.

Laravel 4: setting correct scheme and domain for pagination and form

This is probably an oversight on my part, but I am wondering what's the correct way to set the default pagenate base url.
Our domain is on https://domain.com and we have set config app.url as such, but pagination still appear to use http://domain.com (note the scheme is http instead of https) when generating url in view. I am wondering how to do this without writing setBaseUrl everywhere.
(We are using Laravel 4.1)
Update: we got the same problem with Form::open as well, where is the setting that make Laravel realize we want url with https instead of http? Shouldn't it be using app.url as a base url?
Figure out the answer myself:
Since our server is behind a reverse proxy (nginx), while content is served as HTTPS, the proxying is done with HTTP, so we should set following to nginx config:
proxy_set_header X-Forwarded-Proto $scheme; //or just `https`
(same as your proxy_pass upstream block)
Then we can use Trusting Proxies feature as such:
$proxies = Config::get('app.trusted_proxies');
// trust any balancer
if ($proxies === '*')
{
$proxies = array( Request::getClientIp() );
}
// else trust an array of IPs
if ($proxies && is_array($proxies))
{
Request::setTrustedProxies($proxies);
}
(This can be added to bootstrap/start.php. Laravel use Symfony Request library, which is why we linked to their document, as this feature is not documented in Laravel docs)

Categories