gitmedia/presseportale
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

security: Proxy-Vertrauen nur noch lokal, HSTS in Produktion, Tests ohne echte ntfy-Pushes

Browse source 
Live-Prüfung 08.10.2026: nginx beantwortet die Anfragen direkt (kein CDN,
kein vorgeschalteter Proxy), die App vertraute aber jedem Proxy
(trustProxies at '*'). Jeder Client konnte per X-Forwarded-For seine IP
vorgeben und damit IP-Limits bei Login und Passwort-Reset umgehen sowie
IP-Protokolle fälschen. Jetzt steuert config/trustedproxy.php das Vertrauen:
lokal (Traefik) weiterhin '*', sonst keinem Proxy; ein späteres CDN kommt
über TRUSTED_PROXIES dazu.

HSTS fehlte auf Live. SecurityHeaders setzt Strict-Transport-Security auf
HTTPS-Antworten, standardmäßig nur in Produktion (max-age 1 Jahr, bewusst
ohne includeSubDomains/preload).

phpunit.xml leert MONITORING_NTFY_*, damit Testläufe keine echten
Push-Nachrichten mehr auslösen.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Kevin Adametz 2026-10-08 11:41:24 +00:00
parent f693226d4a
commit 3def447f51
7 changed files with 121 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

49
tests/Feature/SecurityHardeningTest.php
View file

@ -4,6 +4,7 @@ use App\Models\Company;
use App\Models\User;
use Database\Seeders\RolesAndPermissionsSeeder;
use Illuminate\Http\UploadedFile;
use Illuminate\Support\Facades\Process;
use Illuminate\Support\Facades\RateLimiter;
use Illuminate\Support\Facades\Route;
use Illuminate\Support\Facades\Storage;
@ -99,3 +100,51 @@ test('company create rejects svg logos', function () {
expect(Company::query()->where('name', 'SVG GmbH')->exists())->toBeFalse();
});
test('https responses carry hsts only when it is enabled', function () {
/** @var TestCase $this */
$this->get('https://presseecho.test/de')->assertHeaderMissing('Strict-Transport-Security');
config()->set('security.hsts', ['enabled' => true, 'max_age' => 31536000]);
$this->get('https://presseecho.test/de')->assertHeader('Strict-Transport-Security', 'max-age=31536000');
$this->get('http://presseecho.test/de')->assertHeaderMissing('Strict-Transport-Security');
});
test('forwarded client ips are ignored unless the proxy is trusted', function () {
/** @var TestCase $this */
Route::get('/_test/client-ip', fn () => request()->ip());
$this->withServerVariables(['REMOTE_ADDR' => '203.0.113.10'])
->withHeader('X-Forwarded-For', '198.51.100.7')
->get('/_test/client-ip')
->assertContent('203.0.113.10');
config()->set('trustedproxy.proxies', '203.0.113.10');
$this->withServerVariables(['REMOTE_ADDR' => '203.0.113.10'])
->withHeader('X-Forwarded-For', '198.51.100.7')
->get('/_test/client-ip')
->assertContent('198.51.100.7');
});
test('production trusts no proxy unless one is configured', function (string $appEnv, ?string $trustedProxies, ?string $expected) {
$code = 'require "vendor/autoload.php"; echo json_encode((require "config/trustedproxy.php")["proxies"]);';
$result = Process::path(base_path())
->env(array_filter(['APP_ENV' => $appEnv, 'TRUSTED_PROXIES' => $trustedProxies], fn ($value) => $value !== null) + ['TRUSTED_PROXIES' => false])
->run([PHP_BINARY, '-r', $code]);
expect(json_decode($result->throw()->output()))->toBe($expected);
})->with([
'live without setting' => ['production', null, null],
'local behind traefik' => ['local', null, '*'],
'live behind a cdn' => ['production', '10.0.0.0/8', '10.0.0.0/8'],
'explicitly empty' => ['local', '', null],
]);
test('the test suite never sends real ntfy pushes', function () {
expect(config('monitoring.alerts.ntfy.url'))->toBeEmpty()
->and(config('monitoring.alerts.ntfy.topic'))->toBeEmpty()
->and(config('monitoring.alerts.ntfy.token'))->toBeEmpty();
});