Make Laravel use HTTPs by default

Question

I deployed my website, and used this code to enforce that the protocol used is HTTPs \Illuminate\Support\Facades\URL::forceScheme('https'); in the AppServiceProvider.

When I visit my website, it uses HTTP by default and I have to manually change 'http' to 'https' in the address bar and then the SSL certificate works fine and I can fill all forms securely.

How can I enforce that when the user visits the website, HTTPs runs not HTTP

What is your APP_URL value in your .env file - it should be https://yourdomain.com — Giles Bennett, Dec 15 '21 at 17:52
I did that in a middleware, but I get an error "WEBSITE DOMAIN redirected you too many times. Try clearing your cookies. ERR_TOO_MANY_REDIRECTS" — Mohamed Yehia, Dec 15 '21 at 18:11
Does this answer your question? [How to force Laravel Project to use HTTPS for all routes?](https://stackoverflow.com/questions/35827062/how-to-force-laravel-project-to-use-https-for-all-routes) — erwan, Dec 15 '21 at 18:43

score 1 · Answer 1 · answered Sep 04 '22 at 04:48

Pls try this,

Create file HttpsProtocol.php locate in app/Http/Middleware, add below code:

<?php
namespace App\Http\Middleware;

use Closure;

class HttpsProtocol {

public function handle($request, Closure $next)
{
    if (!$request->secure()) {
       return redirect()->secure('/');
    }
       return $next($request); 
    }
}
?>

add this line to $middlewareGroups section in app/Http/Kernel.php

\App\Http\Middleware\HttpsProtocol::class,

Enjoy!

score 0 · Answer 2 · answered Dec 15 '21 at 18:18

Add this tag to your root page head section.(home.blade.php,welcome.blade.php ...)

<head>
... other tags
    @if(env('APP_ENV') === 'production')
    <meta http-equiv="Content-Security-Policy" content="upgrade-insecure-requests">
    @endif
</head>

And inside boot function app/Providers/AppServiceProvider.php Add :

 public function boot()
    {
      if (env('APP_ENV') === 'production') {
          $this->app['request']->server->set('HTTPS', true);
      }
    }
}

score 0 · Answer 3 · answered Dec 16 '21 at 15:38

I used \Illuminate\Support\Facades\URL::forceScheme('https'); however, my first page was still loaded in HTTP and other subsequent requests were in HTTPs.

To fix this, I redirected the route at "/" to a clone route "/welcome" which returns the view which "/" was supposed to return. From that point onwards HTTPs is used.

I could not redirect HTTP to HTTPs in the server because I use Elastic beanstalk and the proposed commands in the /.ebextensions config file didnt work, so my solution is as close to fixing the problem as I could get

Make Laravel use HTTPs by default

3 Answers3