Laravel Force HTTPS重定向您太​​多次

Question

i am trying to force every route to use HTTPS instead of HTTP

This is how i did it. I created middleware ForceHttps

<?php

namespace App\Http\Middleware;

use Closure;
use Illuminate\Support\Facades\App;

class ForceHttps
{
    /**
     * Handle an incoming request.
     *
     * @param  \Illuminate\Http\Request  $request
     * @param  \Closure  $next
     * @return mixed
     */
    public function handle($request, Closure $next)
    {
        if (!$request->secure() && App::environment() === 'production'{
            return redirect()->secure($request->getRequestUri());
        }

        return $next($request);
    }
}

And i have applied this middleware to every web route

/**
 * The application's route middleware groups.
 *
 * @var array
 */
protected $middlewareGroups = [
    'web' => [
        \App\Http\Middleware\EncryptCookies::class,
        \Illuminate\Cookie\Middleware\AddQueuedCookiesToResponse::class,
        \Illuminate\Session\Middleware\StartSession::class,
        // \Illuminate\Session\Middleware\AuthenticateSession::class,
        \Illuminate\View\Middleware\ShareErrorsFromSession::class,
        \App\Http\Middleware\VerifyCsrfToken::class,
        \Illuminate\Routing\Middleware\SubstituteBindings::class,
        \App\Http\Middleware\ForceHttps::class, // <----
    ],

    'api' => [
        'throttle:60,1',
        'bindings',
    ],
];

When i try to access my page it says: This page isn't working testpage.herokuapp.com redirected you too many times.

I am using heroku to host my webpage

Answer 1

This is not just your middleware. Heroku uses load balancing to better distribute the workloads.

Furthermore from the Heroku documentation:

Heroku's HTTP Routing routes each request through a layer of reverse proxies which are, among other things, responsible for load balancing and terminating SSL connections. This means that requests received by a dyno will have the last router's IP address in the REMOTE_ADDR environment variable, and the internal request will always be made using the HTTP protocol, even if the original request was made over HTTPS.

If you are using fideloper/proxy (if not you should), configure the TrustProxies middleware like so:

<?php

namespace Api\Http\Middleware;

use Illuminate\Http\Request;
use Fideloper\Proxy\TrustProxies as Middleware;

class TrustProxies extends Middleware
{
    /**
     * The trusted proxies for this application.
     *
     * @var array
     */
    protected $proxies = '*';

    /**
     * The current proxy header mappings.
     *
     * @var array
     */
    protected $headers = Request:: HEADER_X_FORWARDED_AWS_ELB;
}

FYI I am running an API written with Laravel on Heroku and here is the middleware property of my Kernel.php :

protected $middleware = [
    \Illuminate\Foundation\Http\Middleware\CheckForMaintenanceMode::class,
    \Api\Http\Middleware\TrustProxies::class,
    \Api\Http\Middleware\RedirectToHttps::class,
    \Api\Http\Middleware\PreflightCors::class,
    \Api\Http\Middleware\TrimStrings::class,
    \Illuminate\Foundation\Http\Middleware\ValidatePostSize::class,
    \Illuminate\Foundation\Http\Middleware\ConvertEmptyStringsToNull::class
];

You should really read these paragraphs, which explain in full what I briefly described above:

• https://laravel.com/docs/5.6/requests#configuring-trusted-proxies
• https://devcenter.heroku.com/articles/getting-started-with-laravel#trusting-the-load-balancer