Laravel Https is middleware to check for Secure HTTP requests. Laravel Https middleware providers can check and redirect if the user is not hitting the https url of your app/site or the request can be automatically redirected to a Secure Http (HTTPS) request.
jeremykenedy/laravel-https is a Laravel package for laravel https is middleware to check for secure http requests. laravel https middleware providers can check and redirect if the user is not hitting the https url of your app/site or the request can be automatically redirected to a secure http (https) request..
It currently has 36 GitHub stars and 137.995 downloads on Packagist (latest version v3.0.0).
Install it with composer require jeremykenedy/laravel-https.
Discover more Laravel packages by jeremykenedy
or browse all Laravel packages to compare alternatives.
Last updated
Laravel middleware to redirect HTTP requests to HTTPS or deny insecure requests.
The test suite runs against these combinations:
| Laravel | PHP in CI | |---------|-----------| | 5.1, 5.2, 5.3, 5.4, 5.5, 5.6, 5.7, 5.8, 6 | 7.2 | | 7 | 7.4 | | 8 | 8.0 | | 9 | 8.1 | | 10, 11 | 8.2 | | 12 | 8.2, 8.3 | | 13 | 8.3, 8.4, 8.5 |
Historical releases are tested for compatibility with existing applications. This does not extend Laravel's security support for those releases. See the Laravel support policy.
This is a middleware package. It works with Blade, Livewire, Vue, React, Svelte, and API clients without frontend dependencies or a build step.
composer require jeremykenedy/laravel-https
Laravel 5.5 and later discover the service provider automatically. On Laravel 5.1 through 5.4, add it to the providers array in config/app.php:
jeremykenedy\LaravelHttps\LaravelHttpsServiceProvider::class,
Publishing is optional. There is no package install command and no automatic file replacement during Composer updates.
Redirect HTTP requests to HTTPS in production:
use Illuminate\Support\Facades\Route;
Route::get('/account', function () {
return view('account');
})->middleware('forceHTTPS');
Deny insecure requests instead of redirecting:
Route::group(['middleware' => ['checkHTTPS']], function () {
Route::get('/private', function () {
return response()->json(['message' => 'Secure request accepted.']);
});
});
Both middleware names can also be passed to $this->middleware() in controllers that support constructor middleware. You can use the middleware classes directly when registering global middleware:
jeremykenedy\LaravelHttps\App\Http\Middleware\CheckHTTPS::class
jeremykenedy\LaravelHttps\App\Http\Middleware\ForceHTTPS::class
API clients should send Accept: application/json when using checkHTTPS.
forceHTTPS redirects insecure requests with their path and query string intact.checkHTTPS returns the existing error page or a JSON denial.Publish the configuration if you want to edit it:
php artisan vendor:publish --tag=LaravelHttps
Edit config/laravel-https.php or set the corresponding environment variables:
| Configuration key | Environment variable | Default | Behavior |
|-------------------|----------------------|---------|----------|
| ForceHttpsCheckEnvironment | LARAVEL_FORCEHTTPSCHECKENVIRONMENT | true | Enables redirects in the configured environment. Setting this to false disables redirects. |
| ForceHttpsEnvironmentToCheck | LARAVEL_FORCEHTTPSENVIRONMENTTOCHECK | production | Environment in which forceHTTPS redirects. The config value can also be an array of environments. |
| httpsAccessDeniedErrorCode | LARAVEL_HTTP_ERROR_CODE | 403 | JSON status and code, HTML view name, and fallback denial status. |
| httpsAccessDeniedHtmlStatus | LARAVEL_HTTPS_HTML_STATUS | 200 | Status for an existing HTML error view. The default preserves previous releases. Set to 403 to return a forbidden status. |
The existing LaravelHttps config namespace remains available, including calls such as config('LaravelHttps.httpsAccessDeniedErrorCode'). Values explicitly set in that namespace take precedence over the published laravel-https config. Rebuild your application's config cache after changing configuration.
forceHTTPS retains its 302 redirect, including for POST requests. Clients may follow a 302 with a GET, so send API writes directly to HTTPS. It does nothing outside the configured environment or when ForceHttpsCheckEnvironment is false.
checkHTTPS denies insecure requests in every environment. AJAX requests and requests preferring JSON receive:
{
"code": 403,
"message": "403 | ForbiddenSSL(HTTPS) is required to view"
}
The existing message format and translation keys are preserved. Other requests render LaravelHttps::errors.403. If a view for the configured error code is missing, Laravel aborts with that code and message. Errors inside an existing custom view are allowed to surface normally.
To opt into an HTTP 403 status for the HTML error page:
LARAVEL_HTTPS_HTML_STATUS=403
Both middleware use Laravel's request security detection. Configure trusted proxies in your application when TLS terminates at a load balancer, otherwise HTTPS traffic can be seen as HTTP and redirected repeatedly. Untrusted X-Forwarded-Proto headers do not bypass the middleware. Follow the Laravel trusted proxy documentation for your framework version.
The existing LaravelHttps publish tag writes:
| Files | Destination |
|-------|-------------|
| Configuration | config/laravel-https.php |
| Error views | resources/views/vendor/laravel-https |
| Translations | resources/lang/vendor/laravel-https |
The lowercase view and translation directories are now loaded correctly. Existing views in resources/views/vendor/LaravelHttps still take precedence. Partial translation overrides retain the package defaults and Laravel's fallback locale behavior. The historical httpsRequredError and httpsRequred translation keys keep their spelling for compatibility.
Publishing without --force keeps existing files. Composer updates never publish or overwrite application files.
composer update jeremykenedy/laravel-https
The middleware names, namespace, environment variables, publishing paths, PHP constraint, default redirects, JSON payload, and existing HTML page remain compatible. Published configuration, views, and translations that were previously ignored will now take effect, so review any existing overrides before updating.
See CHANGELOG.md for changes.
This package uses Laravel's existing commands:
| Command | Purpose | Options |
|---------|---------|---------|
| vendor:publish --tag=LaravelHttps | Publish optional config, views, and translations. | --force replaces existing published files. Use only when you intend to discard customizations. |
| config:clear | Clear cached configuration after changes. | None needed. |
| config:cache | Rebuild configuration for deployment. | None needed. |
For development, use PHP 8.3 or later to install the current framework, PHPUnit, and Pint:
composer install
composer test
composer lint:test
composer validate --strict
composer audit
Run composer lint to apply formatting. With Xdebug enabled, run:
XDEBUG_MODE=coverage vendor/bin/phpunit --configuration phpunit.coverage.xml --coverage-text
Tests use a real Laravel container, router, view compiler, and translator. They cover secure requests, redirects, query strings, environments, JSON and AJAX denials, custom statuses, missing views, published overrides, and trusted proxies.
The CI matrix selects framework and PHPUnit versions for each PHP runtime. Historical compatibility jobs permit archived dependencies with known advisories in those isolated test jobs only. Current Laravel jobs retain Composer's security blocking, and the quality job audits current dependencies.
This package is open-sourced software licensed under the MIT license.
