https://github.com/mehdibo/Codeigniter-SSLHook

Appropriate headers and redirection for SSL websites
https://github.com/mehdibo/Codeigniter-SSLHook

codeigniter headers hooks security ssl ssl-support

Last synced: about 1 month ago
JSON representation

Appropriate headers and redirection for SSL websites

• Host: GitHub
• URL: https://github.com/mehdibo/Codeigniter-SSLHook
• Owner: mehdibo
• License: mit
• Archived: true
• Created: 2018-04-10T22:25:45.000Z (over 6 years ago)
• Default Branch: master
• Last Pushed: 2021-12-06T11:45:07.000Z (about 3 years ago)
• Last Synced: 2024-02-15T10:37:16.340Z (10 months ago)
• Topics: codeigniter, headers, hooks, security, ssl, ssl-support
• Language: PHP
• Size: 7.81 KB
• Stars: 22
• Watchers: 4
• Forks: 6
• Open Issues: 0
• Metadata Files:
  • Readme: README.md
  • License: LICENSE

Awesome Lists containing this project

• awesome-morocco - Codeigniter-sslhook - SSLHook.svg?style=social)](https://github.com/mehdibo/Codeigniter-SSLHook/stargazers) - A tool to set appropriate headers/redirection for SSL websites (Uncategorized / Uncategorized)
• awesome-codeigniter - CodeIgniter-SSLHook - Appropriate headers and redirection for SSL websites . (Hooks)

README

        
> :warning:  I no longer maintaing this project, if you have access to the server add these headers and redirections early on before the request even reaches the application 

Codeigniter-SSLHook

============================

This hook will automatically redirect to the HTTPS version of your website and set the appropriate headers.

Installation

-----------------

Make sure your `base_url` starts with `https`

Copy `/application/config/hooks.php`  into your `application`'s folder.

If you have other hooks copy the content of `/application/config/hooks.php` to your `hooks.php` file.

Enable hooks by modifying your `/application/config/config.php`, set `enable_hooks` to `TRUE`:

```php

/*

|--------------------------------------------------------------------------

| Enable/Disable System Hooks

|--------------------------------------------------------------------------

|

| If you would like to use the 'hooks' feature you must enable it by

| setting this variable to TRUE (boolean).  See the user guide for details.

|

*/

$config['enable_hooks'] = TRUE;

```

How does it work?

-----------------

The hook will:

- Redirect to the HTTPS version if accessed from a non-secure connection.

- Make cookies only accessible via HTTPS (no JavaScript)

- Set the following headers:

  -  `Strict-Transport-Security: max-age=2629800`

  -  `X-Content-Type-Options: nosniff`

  -  `Referrer-Policy: strict-origin`

  -  `X-Frame-Options: DENY`

  -  `X-XSS-Protection: 1; mode=block`