I have developed a service in which users can use this service on their websites, they should put a global URL in the iframe
tag in their websites.
Now I should check the domain name which this iframe
loaded on that domain to verify is this site has permission to use this iframe or not.
So I wrote middleware in my controller but I'm not sure how I can get the domain address where the iframe is located. is used $request->headers->get('origin')
but it's not works.
public function __construct(Request $request)
{
$this->middleware(function ($request, $next) {
if (!empty($this->trust_domains)) {
$domains = explode(',', $this->trust_domains);
$request_host = parse_url($request->headers->get('origin'), PHP_URL_HOST);
if (!in_array($request_host, $domains)) {
return response('You don\'t have access to this section', 403);
}
}
return $next($request);
});
}