How to Force HTTPS in Laravel

A detailed guide on how to force HTTPS in Laravel, ensuring all requests to your application are redirected to HTTPS, thus enhancing your website's security.

We will use Laravel's built-in methods to redirect all HTTP requests to HTTPS. This will be done by configuring the AppServiceProvider.php file and the .env configuration file.

Step 1: Configure in AppServiceProvider.php

Open App\Providers\AppServiceProvider.php and add the following code in the boot() method:

namespace App\Providers;

use Illuminate\Support\ServiceProvider;
use Illuminate\Support\Facades\URL;

class AppServiceProvider extends ServiceProvider
{
    /**
     * Bootstrap any application services.
     *
     * @return void
     */
    public function boot()
    {
        if (config('app.env') === 'production') {
            URL::forceScheme('https');
        }
    }

    /**
     * Register any application services.
     *
     * @return void
     */
    public function register()
    {
        //
    }
}

Detailed explanation

1. use Illuminate\Support\Facades\URL;: This imports the URL facade to enforce HTTPS.
2. if (config('app.env') === 'production'): Checks if the environment is production before enabling force HTTPS.
3. URL::forceScheme('https');: Forces all URLs generated by the Laravel application to use HTTPS.

Step 2: Configure the .env file

Ensure that your .env file is set with APP_ENV as production and APP_URL uses https. Example:

APP_ENV=production
APP_URL=https://your-domain.com

Step 3: Set up HTTPS on your server

If you're using Nginx or Apache, ensure you configure your web server to support HTTPS and install the SSL certificate.

How to install and configure to run force HTTPS on Laravel

1. Install an SSL certificate for your domain using Let’s Encrypt or another provider.
2. Configure your server to redirect HTTP to HTTPS:
   • For Nginx:

     server {
         listen 80;
         server_name your-domain.com www.your-domain.com;
         return 301 https://$host$request_uri;
     }
     

   • For Apache:

     <VirtualHost *:80>
         ServerName your-domain.com
         Redirect "/" "https://your-domain.com/"
     </VirtualHost>

Tips

• Ensure your SSL certificate is always renewed and up-to-date.
• Test the redirection by accessing your website via HTTP and ensuring it redirects to HTTPS.