The ArtisanPack UI Security package automatically adds essential security headers to all outgoing responses to protect your application from common attacks like clickjacking and cross-site scripting (XSS).
Configuration
The headers are enabled by default. You can customize them by publishing the package's configuration file:
php artisan vendor:publish --tag=artisanpack-package-config
This will create a config/artisanpack/security.php file in your application. You can then edit the security-headers array to modify or disable specific headers. To disable a header, set its value to null or an empty string.
// config/artisanpack/security.php
'security-headers' => [
'Strict-Transport-Security' => 'max-age=31536000; includeSubDomains',
'X-Frame-Options' => 'SAMEORIGIN',
'X-Content-Type-Options' => 'nosniff',
'X-XSS-Protection' => '1; mode=block',
'Referrer-Policy' => 'no-referrer-when-downgrade',
// Disable CSP by setting it to null
'Content-Security-Policy' => null,
],
Default Headers
- Strict-Transport-Security: Enforces HTTPS across your site.
- X-Frame-Options: Protects against clickjacking.
- X-Content-Type-Options: Prevents MIME-sniffing.
- X-XSS-Protection: A basic XSS filter (mostly for older browsers).
- Referrer-Policy: Controls how much referrer information is sent.
- Content-Security-Policy (CSP): A powerful tool to prevent XSS and data injection attacks. The default is very restrictive (
default-src 'self'); you will likely need to customize it for your application.