mirror of
https://github.com/BookStackApp/BookStack.git
synced 2024-08-25 11:45:58 +00:00
![Dan Brown](/assets/img/avatar_default.png)
Added iframe CSP headers with configuration via .env. Updated session cookies to be lax by default, dynamically changing to none when iframes configured to allow third-party control. Updated cookie security to be auto-secure if a https APP_URL is set. Related to #2427 and #2207.
56 lines
2.1 KiB
PHP
56 lines
2.1 KiB
PHP
<?php namespace BookStack\Http;
|
|
|
|
use Illuminate\Foundation\Http\Kernel as HttpKernel;
|
|
|
|
class Kernel extends HttpKernel
|
|
{
|
|
/**
|
|
* The application's global HTTP middleware stack.
|
|
* These middleware are run during every request to your application.
|
|
*/
|
|
protected $middleware = [
|
|
\BookStack\Http\Middleware\CheckForMaintenanceMode::class,
|
|
\Illuminate\Foundation\Http\Middleware\ValidatePostSize::class,
|
|
\BookStack\Http\Middleware\TrimStrings::class,
|
|
\BookStack\Http\Middleware\TrustProxies::class,
|
|
];
|
|
|
|
/**
|
|
* The application's route middleware groups.
|
|
*
|
|
* @var array
|
|
*/
|
|
protected $middlewareGroups = [
|
|
'web' => [
|
|
\BookStack\Http\Middleware\ControlIframeSecurity::class,
|
|
\BookStack\Http\Middleware\EncryptCookies::class,
|
|
\Illuminate\Cookie\Middleware\AddQueuedCookiesToResponse::class,
|
|
\Illuminate\Session\Middleware\StartSession::class,
|
|
\Illuminate\View\Middleware\ShareErrorsFromSession::class,
|
|
\BookStack\Http\Middleware\VerifyCsrfToken::class,
|
|
\BookStack\Http\Middleware\Localization::class,
|
|
\BookStack\Http\Middleware\GlobalViewData::class,
|
|
],
|
|
'api' => [
|
|
\BookStack\Http\Middleware\ThrottleApiRequests::class,
|
|
\BookStack\Http\Middleware\EncryptCookies::class,
|
|
\BookStack\Http\Middleware\StartSessionIfCookieExists::class,
|
|
\BookStack\Http\Middleware\ApiAuthenticate::class,
|
|
],
|
|
];
|
|
|
|
/**
|
|
* The application's route middleware.
|
|
*
|
|
* @var array
|
|
*/
|
|
protected $routeMiddleware = [
|
|
'auth' => \BookStack\Http\Middleware\Authenticate::class,
|
|
'can' => \Illuminate\Auth\Middleware\Authorize::class,
|
|
'guest' => \BookStack\Http\Middleware\RedirectIfAuthenticated::class,
|
|
'throttle' => \Illuminate\Routing\Middleware\ThrottleRequests::class,
|
|
'perm' => \BookStack\Http\Middleware\PermissionMiddleware::class,
|
|
'guard' => \BookStack\Http\Middleware\CheckGuard::class,
|
|
];
|
|
}
|