Automatically apply PreventBrowserAccess middleware #551
Conversation
|
Converted to Draft. Will address the feedback given on Discord first 👍🏻 |
|
Couple notes @NativePHP/contributors: I've added the automatic registration inside a
|
|
@gwleuverink i think it does need to be applied globally, not just to the I'm thinking of scenarios where an attacker could use the API endpoints to trigger app behaviour in an unwanted manner simply by using curl against the right port... So, if possible let's go for applying globally. But we need to make sure that all requests from Electron to the Laravel app include the necessary header... |
|
I had to import |
|
I tried this in a simple app. Seems to work as expected. Verification welcome! @simonhamp About the necessary header. Any scenario's this isn't accounted for already? |
|
I don't think so. Just something we need to remember to do in case we add new ways to call the Laravel backend. |
|
Shall I remove this section from the docs entirely or leave a note about this behaviour? At the bottom: |
|
Does anyone remember why we didn't merge this? ^^ I know we had a discussion on Discord too but can't remember the outcome. |
|
I was wondering what to do with the docs & it slipped my mind. Just pushed it: NativePHP/nativephp.com#127 |
|
Merged this in as docs also merged. |
The PreventBrowserAccess middleware causes browser tests to fail with 403's. This PR adds a simple guard clause that skips the middleware when it detects it's running tests.