Nyan Lin Paing
98dacef556
PHP Tests / php-tests (push) Has been cancelled
Staging terminates SSL at a reverse proxy in front of the app, but Laravel had no trustProxies() configured, so it never saw the request as HTTPS and generated http:// asset URLs on the https:// page. Browsers block that as mixed content, which silently broke every JS-enhanced Filament field (FileUpload, Textarea, etc.) — e.g. the Ev Company logo field falling back to a bare native file input. - bootstrap/app.php: trust the proxy via X-Forwarded-* headers. - AppServiceProvider: force the https scheme when APP_URL is https, as a fallback in case the forwarded header is ever missing.
64 lines
2.0 KiB
PHP
64 lines
2.0 KiB
PHP
<?php
|
|
|
|
namespace App\Providers;
|
|
|
|
use Illuminate\Cache\RateLimiting\Limit;
|
|
use Illuminate\Http\Request;
|
|
use Illuminate\Support\Facades\RateLimiter;
|
|
use Illuminate\Support\Facades\URL;
|
|
use Illuminate\Support\ServiceProvider;
|
|
|
|
class AppServiceProvider extends ServiceProvider
|
|
{
|
|
/**
|
|
* Register any application services.
|
|
*/
|
|
public function register(): void
|
|
{
|
|
//
|
|
}
|
|
|
|
/**
|
|
* Bootstrap any application services.
|
|
*/
|
|
public function boot(): void
|
|
{
|
|
$this->configureRateLimiting();
|
|
|
|
// Belt-and-suspenders alongside bootstrap/app.php's trustProxies():
|
|
// that already makes url()/asset() respect the proxy's
|
|
// X-Forwarded-Proto, but if that header is ever missing or a proxy
|
|
// is misconfigured, this still forces https:// asset/route URLs on
|
|
// any environment whose APP_URL is itself https — so a plain-http
|
|
// request never causes a mixed-content-blocked asset again.
|
|
if (str(config('app.url'))->startsWith('https://')) {
|
|
URL::forceScheme('https');
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Named api/* rate limiters (T6.1, domain.md §8) — read-only catalog/
|
|
* routing endpoints get a looser limit than the write-heavy booking/
|
|
* payment endpoints; auth/token issuance and the inbound KBZ webhook
|
|
* each get their own tighter limiter.
|
|
*/
|
|
private function configureRateLimiting(): void
|
|
{
|
|
RateLimiter::for('api-read', function (Request $request) {
|
|
return Limit::perMinute(120)->by($request->user()?->id ?: $request->ip());
|
|
});
|
|
|
|
RateLimiter::for('api-write', function (Request $request) {
|
|
return Limit::perMinute(20)->by($request->user()?->id ?: $request->ip());
|
|
});
|
|
|
|
RateLimiter::for('api-auth', function (Request $request) {
|
|
return Limit::perMinute(10)->by($request->ip());
|
|
});
|
|
|
|
RateLimiter::for('api-webhooks', function (Request $request) {
|
|
return Limit::perMinute(30)->by($request->ip());
|
|
});
|
|
}
|
|
}
|