Laravel Redirect All Requests To HTTPS

Question

Our entire site is to be served over https. I have 'https' in each route. However, how do I redirect them to https if they attempt it over http?

Route::group(array('https'), function()
{
     // all of our routes
}

Answer 1

If you want to redirect to the same URL but using https, you should use Request::getRequestUri() instead of Request::path():

App::before(function($request)
{
    if( ! Request::secure())
    {
         return Redirect::secure(Request::getRequestUri());
    }
});

Answer 2

For laravel 5.1 you should use given code in App\Http\Providers\RouteServiceProvider@boot

$router->filter('force.ssl', function () {
      if ( ! request()->secure() ) {
           return redirect()->secure(request()->path());
      }
});

Now you can use this in routes file.

Route::group(['before' => 'force.ssl'], function () {
    // Routes here
});

you can also add ['before' => 'force.ssl'] in $router->group() in

App\Http\Providers\RouteServiceProvider@map

Answer 3

I've had a problem with forcing ssl while doing POST request. It would always redirect to GET. This happens because Redirect::secure() is by default using a 302 redirect.

To make sure your POST request are redirected properly, use something like

return Redirect::secure("your/path/here", 307)

This will make sure your request will keep original request method after redirect occurs.

Answer 4

For users using Laravel 4/5 and Elastic Beanstalk, forcing HTTPS is difficult using these methods because the isSecure() will return false. Further, using .htaccess redirects will result in a redirect loop for Chrome and delayed page load times in Firefox.

This set up is for

• Laravel 5 and may work for Laravel 3 / 4
• Application loaded onto Elastic Beanstalk running EC2 server instances
• Route 53 used for DNS resolution
• Cloudfront used for global CDN of all assets and enforcing HTTPS
• I run aws on a Windows machine. Linux may vary slightly?

After hours of my own attempts, I managed to get all HTTP requests forwarded to HTTPS using the following steps:

1. Obtain an SSL certificate. Guides and providers are numerous and can be found via a Google search.

2. Upload the certificate to AWS using the aws console command. The command structure is:

   aws iam upload-server-certificate --server-certificate-name CERTIFICATE_NAME --certificate-body "file://PATH_TO_CERTIFICATE.crt" --private-key "file://YOUR_PRIVATE_KEY.pem" --certificate-chain "file://YOUR_CERTIFICATE_CHAIN.ca-bundle" --path /cloudfront/
   

3. Create an Elastic Beanstalk application. Proceed through the setup process. Once the application is setup, go to Configuration -> Network Tier -> Load Balancing and click the gear icon.

4. Select Secure listener port as 443. Select Protocol as HTTPS. Select the CERTIFICATE_NAME from step 2 for SSL certificate ID. Save the configuration.

5. Go to your Console. Click EC2 Instances. Click Load Balancers. Click through the load balancers. Click Instances and scroll down to see the EC2 instances assigned to that load balancer. If the EC2 instance has the same name as your Application URL (or something close), take note of the DNS Name for the load balancer. It should be in the format awseb-e-...

6. Go back to your Console. Click CloudFront. Click Create Distribution. Select a Web distribution.

7. Set up the distribution. Set your Origin Domain Name to the load balancer DNS name you found in step 5. Set the Viewer Protocol Policy to Redirect HTTP to HTTPS. Set Forward Query Strings to Yes. Set Alternate Domain Names (CNAMEs) to the URL(s) you want to use for your application. Set SSL Certificate to the CERTIFICATE_NAME you uploaded in step 2. Create your distribution.

8. Click on your distribution name in CloudFront. Click Origins, select your origin, and click Edit. Ensure your Origin Protocol Policy is Match Viewer. Go back. Click Behaviors, select your origin, and click Edit. Change Forward Headers to Whitelist and add Host. Save.

9. Go to your Console. Click Route 53. Click Hosted Zones. Click Create Hosted Zone. Set up your domain name. Once set up, click Create Record Set. Enter your A record. Select Alias as Yes. Your Alias Target is your CloudFront distribution. Save the record.

10. Set up your nameservers for your domain to point to the Route 53 nameservers. Wait for everything to propagate, which could be a few hours. Go to your URL. You will be automatically redirected to HTTPS.

11. "But wait, my links don't go to HTTPS!?" You need to handle the X-Forwarded-Proto header that CloudFront will pass. For Laravel 4, follow this guide. For Laravel 5, run this:

    php artisan make:middleware EB_SSL_Trust
    

And then add this to the EB_SSL_Trust file:

    public function handle($request, Closure $next)
    {
        $request->setTrustedProxies( [ $request->getClientIp() ] );
        return $next($request);
    }

And add this to your App\Http\Kernel.php file:

    protected $middleware = [
        ...
        'App\Http\Middleware\EB_SSL_Trust',
        ...
    ];

Note: All your assets, such as CSS, JS or images, need to be sent over HTTPS. If you use Laravel to create these links, use secure_asset() to create the HTTPS URL in your View.

Answer 5

Combining previous answers to use constants and methods that are available in Laravel 4.2.

routes.php

Route::when('*', 'secure');

filters.php

use Illuminate\Http\Response as IlluminateResponse;

Route::filter('secure', function ()
{
    if ( ! Request::secure() && Request::getPort() != 443)
    {
        return Redirect::secure(
            Request::path(),
            in_array(Request::getMethod(), ['POST', 'PUT', 'DELETE'])
                ? IlluminateResponse::HTTP_TEMPORARY_REDIRECT
                : IlluminateResponse::HTTP_FOUND
        );
    }
});

Answer 6

The use of filters has been deprecated in Laravel 5.1.*. This is a perfect job for a MiddleWare.

Create a Middleware and in the handle section put

public function handle($request, Closure $next)
{
    if(! $request->secure()) {
        return redirect()->secure($request->path());
    }
    return $next($request);
}

Then simply register your middleware in your Kernel.php and use it with your routes or controllers.