feat(auth): harden authentication and add configurable two-factor support

2026-07-31 03:12:46 +02:00
parent 235d5f646c
commit e47243f7dc
51 changed files with 2904 additions and 1359 deletions
--- a/app/Http/Middleware/AddSecurityHeaders.php
+++ b/app/Http/Middleware/AddSecurityHeaders.php
@@ -0,0 +1,58 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Closure;
+use Illuminate\Http\Request;
+use Symfony\Component\HttpFoundation\Response;
+
+class AddSecurityHeaders
+{
+    public function handle(Request $request, Closure $next): Response
+    {
+        $response = $next($request);
+
+        $response->headers->set('X-Content-Type-Options', 'nosniff');
+        $response->headers->set('X-Frame-Options', 'DENY');
+        $response->headers->set('Referrer-Policy', 'strict-origin-when-cross-origin');
+        $response->headers->set(
+            'Permissions-Policy',
+            'camera=(), geolocation=(), microphone=(), payment=(), usb=()'
+        );
+
+        if (app()->isProduction()) {
+            $response->headers->set(
+                'Content-Security-Policy',
+                "default-src 'self'; base-uri 'self'; connect-src 'self'; font-src 'self' data:; form-action 'self'; frame-ancestors 'none'; img-src 'self' data:; object-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'"
+            );
+
+            if ($request->isSecure()) {
+                $response->headers->set(
+                    'Strict-Transport-Security',
+                    'max-age=63072000; includeSubDomains; preload'
+                );
+            }
+        }
+
+        if ($this->containsAuthenticationSecrets($request)) {
+            $response->headers->set(
+                'Cache-Control',
+                'no-store, no-cache, must-revalidate, private'
+            );
+            $response->headers->set('Pragma', 'no-cache');
+            $response->headers->set('Expires', '0');
+        }
+
+        return $response;
+    }
+
+    private function containsAuthenticationSecrets(Request $request): bool
+    {
+        return $request->routeIs([
+            'login',
+            'password.*',
+            'two-factor.*',
+            'profile.show',
+        ]);
+    }
+}