Why is asset() not secure?

That’s strange, as I can’t reproduce your problem. When using asset() on https I also see that the asset() url is prefixed with https. Did you provide the https prefix in the APP_URL parameter (in .env)?

Are you using Let’s encrypt?

I see you could also use the secure_asset() function from the Laravel docs: https://laravel.com/docs/master/helpers#method-secure-asset

Thanks. It's really odd. I'm deploying to AWS, but I can see my environment variables, and it's as I expect:

APP_URL: https://www.example.com ("example" inserted for privacy)

I've looked through the Laravel source and it's indeed looking at that variable...

if (! function_exists('asset')) {
    /**
     * Generate an asset path for the application.
     *
     * @param  string  $path
     * @param  bool|null  $secure
     * @return string
     */
    function asset($path, $secure = null)
    {
        return app('url')->asset($path, $secure);
    }
}

So why is it changing it to http://www.example.com? So strange! :(

My local .env file is http://localhost, but that's always what I have it set to. None of those local environment variables are being used anywhere, they're all being replaced by the AWS config.

Agh! It's an issue with AWS and Load Balancers... and it gets me every time!

Solution here: https://stackoverflow.com/a/51194202/199700

Aha!

I don't have experience with load balancers, but I am glad that you've solved it 👍

Mark as answered?