2

I have the following code: 

Route::get('/',   function()
{
    return 'non secure page';
});
Route::get('/',  array('https' => true, function()
{
    return 'secure page';
}));

What I expected to happen is that these two routes would be treated differently. The first is for http://example.com requests and the second for https://example.com. Respectively, these pages should show the text 'non secure page' and 'secure page'. What actually happens is that both show the text 'secure page'. This must mean that both routes are treated the same i.e. it doesn't matter if the request was over https or http - the same route is triggered.

I know I can resolve my issue by using if (Request::secure()){ //routes }; but that then leads me to the question what use are the HTTPS secure routes in laravel? What do they achieve and when should they be used?

I've looked at the docs, but it's not clear to me what is supposed to happen.

GWed
  • 15,167
  • 5
  • 62
  • 99
  • 1
    That is weird, I've tried for myself and you're right, the secure route is called even on a non-secure call. Let's see of someone will enlighten us :) – Adrenaxus Mar 15 '13 at 15:55
  • Have you done anything to your server/.htaccess file that would route all http routes to https routes? – Jonathan Mar 16 '13 at 17:04
  • @Jonathan No, haven't touched my htaccess file. Do the routes work for you then? – GWed Mar 18 '13 at 11:58

2 Answers2

8

The documentation says:

When defining routes, you may use the "https" attribute to indicate that the HTTPS protocol should be used when generating a URL or Redirect to that route.

"https" and ::secure() are only used when generating URLs to routes, they're not used to provide https-only routes. You could write a filter to protect against non-HTTPS routes (example below). Or if you want to prevent any non-HTTPS access to your entire domain then you should reconfigure your server, rather than do this in PHP.

Route::filter('https', function() {
    if (!Request::secure()) return Response::error(404);
});

Alternative filter response:

Route::filter('https', function() {
    if (!Request::secure()) return Redirect::to_secure(URI::current());
});

References:

  1. http://laravel.com/docs/routing#https-routes
  2. http://laravel.com/docs/routing#filters
Phill Sparks
  • 20,000
  • 3
  • 33
  • 46
3

The problem is not related to HTTPS.

The documentation says,

Note: Routes are evaluated in the order that they are registered, so register any "catch-all" routes at the bottom of your routes.php file.

It means that your 

Route::get('/',  array('https' => true, function()
{
    return 'secure page';
}));

is over-writing

Route::get('/',   function()
{
    return 'non secure page';
});

I was actually lead here by Spark from laravel.io and I thought I would clarify the doubt anyhow.

Regards

Chandrahas
  • 31
  • 1