How I can force all my routes to be HTTPS not HTTP

@roulendz

Laravel 4.x http://stackoverflow.com/a/19968614/610880

Laravel 5.x http://stackoverflow.com/a/28403907/610880

@roulendz

Have you tried set the APP_URL option in your .env file to https?

Mine has been working so far and it's the only change I've made.

I've got a helpful little middleware I use that can be applied to all routes or just specific ones:

<?php

namespace App\Http\Middleware;

use Closure;

class ForceSSL
{
    /**
     * Handle an incoming request.
     *
     * @param  \Illuminate\Http\Request $request
     * @param  \Closure $next
     * @return mixed
     */
    public function handle($request, Closure $next)
    {
        if (!$request->secure() && in_array(env('APP_ENV'), ['stage', 'production'])) {
            return redirect()->secure($request->getRequestUri());
        }

        return $next($request);
    }
}

But, if you want to enforce SSL on all routes, you're probably best off doing that with your apache/nginx config.

I do it in the apache config.

Create a virtualhost like;

<VirtualHost *:80>
   ServerName rotarota.net
   ServerAlias www.rotarota.net
   Redirect permanent / https://rotarota.net/
</VirtualHost>

Anything coming in on port 80 is bounced to the https version

I have made NO changes in the laravel code, and its going to be a lot quicker than booting all the framework only to redirect

I thought the problem was assets being loaded using HTTP from an HTTPS page (causing them to not be loaded at all for security reasons).

If you want to force the site to be loaded from HTTPS I prefer to do it in the web server (See How to force or redirect to SSL in nginx? ).

add the code to your .htaccess file

RewriteEngine On RewriteCond %{SERVER_PORT} 80 RewriteRule ^(.*)$ https://www.example.com/$1 [R,L]

All the routes will be now forced to use https

I would place this in the AppServiceProvider in the boot() method, or maybe create a ForceHttpsMiddleware

if($this->app->environment('production')) {
    URL::forceScheme('https');
}

If you want to force all your routes to be HTTPS , here is a solution that worked for me.

First create a middleware.

php artisan make:middleware ForceSSL

This is what your middleware should look like.

For those wondering about this "Issue" here's what I found...

I deployed my laravel app to Azure App Services.

In Azure app services, the app gets served entirely as an http app. Azure then uses a proxy to add https

The problem is, Laravel /sees/ the request as http.

The documentation states the url helpers base the http/https off the current request, which, in azure, always looks like http.

While it's true that you can do some modRewrite type stuff to force those http URLS to map to an HTTPS url, that doesn't really help , because the pages still render to the browser with http links.

So it's necessary to do something like Roulendz did to force laravel to render http links.

@jack edit your last line?

If you're trying to make this work with laravel 5.8+, do this:

// AppServiceProvider.php

public function boot()
{
    if (env('APP_ENV') !== 'local') {
        URL::forceScheme('https');
    }
}

Wouldn't it make sense to build into the core?

Anyway I changed my approach a bit from @dimsav

if (env('APP_FORCE_HTTPS', false)) {
    URL::forceScheme('https');
}

@emilmoe because with the correct hosting setup, this is never required.

Same solution used here - Unfortunately, I am having a Laravel app behind a load balancer redirecting HTTPS connections to HTTP connection

File modified : app/Providers/AppServiceProvider.php

Line added to the function boot() : URL::forceScheme('https');

That's a good way to solve your problem. But when deploying a Laravel application you should remove the .env file and use it only on your local development environment.

Instead, set all your production configurations inside the config directory and change your code to this:

if (config('app.env') === 'production') {
    URL::forceSchema('https');
}

hey. it should be:

\URL::forceScheme('https'); 

*** not Schema

Just an FYI. If your hosting works correctly and sets the correct headers, you only need to add the proxy (load balancer or whatever) to the TrustProxys middleware and Laravel will automatically figure everything out. https://laravel.com/docs/8.x/requests#configuring-trusted-proxies

youre .env file is empty or removed,check youre .env file

In app/Providers/AppServiceProvider.php Add this lines:

    public function boot(): void
    {
       if (app()->isProduction()) {
            ($this->{'app'}['request'] ?? null)?->server?->set('HTTPS','on');
            \Illuminate\Support\Facades\URL::forceScheme('https');
        }
   }

I think you should do it from the server side

You can also modify the .htaccess file in the public folder like this:

	RewriteEngine On

    # Always redirect to HTTPS
    RewriteCond %{HTTPS} !=on
    RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]