How to set secure flag on cookies in laravel

Configuring the secure flag for cookies in Laravel is a crucial security measure that mitigates the risk of client-side scripts (e.g., JavaScript) accessing cookies set by the server. In Laravel, this can be implemented by utilizing middleware or directly configuring it in the configuration files. Below are two common methods:

Method One: Setting the Secure Flag for Cookies via Middleware

1. Creating Middleware: You can create a new middleware by running the following Artisan command:

   bash
   php artisan make:middleware SecureCookieMiddleware

2. Editing the Middleware: Open the newly created middleware file, typically located at app/Http/Middleware/SecureCookieMiddleware.php. In this file, you can configure cookie attributes. For example, you can set the HttpOnly and Secure flags as follows:

   php
   namespace App\Http\Middleware;
   
   use Closure;
   
   class SecureCookieMiddleware
   {
       public function handle($request, Closure $next)
       {
           $response = $next($request);
   
           foreach ($response->headers->getCookies() as $cookie) {
               $cookie->setSecure(true); // Set the secure flag, sending only over HTTPS
               $cookie->setHttpOnly(true); // Set the HttpOnly flag, preventing JavaScript access
           }
   
           return $response;
       }
   }

3. Registering the Middleware: Register your middleware in the $middleware array within the app/Http/Kernel.php file to activate it:

   php
   protected $middleware = [
       // Other middleware...
       \App\Http\Middleware\SecureCookieMiddleware::class,
   ];

Method Two: Setting via Configuration File

Laravel allows you to directly configure the global attributes of cookies in the configuration files. You can set the following in the config/session.php file:

php
/*
|--------------------------------------------------------------------------
| Session Cookie Attributes
|--------------------------------------------------------------------------
|
| These attributes control the properties of session ID cookies generated by the framework. You can fully control these attributes or adjust only a subset, depending on your application's needs.
|
*/

'cookie' => [
    'lifetime' => 120,
    'path' => '/',
    'domain' => null,
    'secure' => true, // Enable secure transmission, effective only over HTTPS
    'httponly' => true, // Enable HttpOnly, preventing JavaScript access
    'samesite' => 'lax', // Set the SameSite attribute
],

In this configuration file, we set the secure and httponly attributes. The secure attribute ensures cookies are only sent over HTTPS, while the httponly attribute restricts JavaScript access to cookies.

Summary

By using the above two methods, you can effectively configure the secure flags for cookies in your Laravel projects. Utilizing middleware provides finer-grained control, suitable for scenarios where you need to set secure flags for specific responses only. Configuring via the configuration file allows for a global and consistent security policy for cookies, with simple and uniform operations.