snicco/open-redirect-protection-middleware

Maintainers

Details

github.com/snicco/open-redirect-protection-middleware

Source

Installs: 9 623

Dependents: 0

Suggesters: 0

Security: 0

Stars: 0

Watchers: 1

Forks: 0

v2.0.0-beta.9 2024-09-07 14:27 UTC

Requires

Requires (Dev)

Conflicts

LGPL-3.0-only 50f3565107ef25c8243dc1d9e1ccf09fb6a8f65d

  • Calvin Alkan <calvin.woop@snicco.de>

This package is auto-updated.

Last update: 2024-12-07 15:11:49 UTC

README

codecov Psalm Type-Coverage Psalm level PhpMetrics - Static Analysis PHP-Versions

This middleware protects your application against open redirects.

It inspects the location header of the response and disallows any redirects to non-whitelisted external hosts.

Instead, the user will be redirected to the configured "exit" page. The intended redirect location will be available in a intented_redirect query variable.

Installation

composer require snicco/open-redirect-protection-middleware

Usage

This middleware should be added globally in the MiddlewareResolver.

The OpenRedirectProtection middleware must be bound in the PSR-11 container that is used by the snicco/http-routing component.

use Snicco\Middleware\OpenRedirectProtection\OpenRedirectProtection;

// In your PSR-11 container.
$open_redirect_protection = new OpenRedirectProtection(
    'snicco.io', // the host of your application
    '/exit', // the page path
    [
        'stripe.com',
        'accounts.stripe.com'    
    ] // Whitelisted domains.
)

Contributing

This repository is a read-only split of the development repo of the Snicco project.

This is how you can contribute.

Reporting issues and sending pull requests

Please report issues in the Snicco monorepo.

Security

If you discover a security vulnerability, please follow our disclosure procedure.