๋ผ๋ผ๋ฒจ ๋ฏธ๋“ค์›จ์–ด๋กœ ์ค‘์š” ํŽ˜์ด์ง€ HTTPS๋กœ ์ œ๊ณตํ•˜๊ธฐ

ย 

์›น ์• ํ”Œ๋ฆฌ์ผ€์ด์…˜์— ๋ธŒ๋ผ์šฐ์ €์™€ ์„œ๋ฒ„๊ฐ„์— ์˜ค๊ฐ€๋Š” ์ •๋ณด๋ฅผ ์•”ํ˜ธํ™”ํ•˜๊ณ  ๋ณดํ˜ธํ•ด์•ผ ํ•  ๊ธฐ๋Šฅ(๋กœ๊ทธ์ธ, ๊ฒฐ์ œ ์ฒ˜๋ฆฌ๋“ฑ)๋“ฑ์ด ์žˆ์„ ๊ฒฝ์šฐ SSL/HTTPS ๋ฅผ ์‚ฌ์šฉํ•˜๋ฉด ์•ˆ์ „ํ•˜๊ฒŒ ์ •๋ณด๋ฅผ ์ฃผ๊ณ  ๋ฐ›์„ ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค.

์ตœ๊ทผ์—๋Š” ํ•˜๋“œ์›จ์–ด์˜ ์‚ฌ์–‘์ด ์ถฉ๋ถ„ํ•˜๋‹ค๋ฉด ์ „์ฒด ์›น ์• ํ”Œ๋ฆฌ์ผ€์ด์…˜์„ HTTPS ๋กœ ์ œ๊ณตํ•˜๋Š” ๊ฒฝ์šฐ๋„ ๋งŽ์ด ์žˆ์Šต๋‹ˆ๋‹ค.

ย 

์ „์ฒด๋ฅผ HTTPS ๋กœ ์ œ๊ณตํ•˜๋ ค๋ฉด ์›น ์„œ๋ฒ„๋‚˜ SSL ๊ฐ€์†๊ธฐ๋“ฑ์—์„œ HTTP ๋กœ ๋“ค์–ด์˜จ ์—ฐ๊ฒฐ์„ HTTPS ๋กœ ์ „ํ™˜ํ•˜๋„๋ก ์„ค์ •ํ•˜๋ฉด ์• ํ”Œ๋ฆฌ์ผ€์ด์…˜์˜ ์ˆ˜์ •์—†์ด ์†์‰ฝ๊ฒŒ ์ฒ˜๋ฆฌํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค.

์˜ˆ๋ฅผ ๋“ค์–ด nginx ์˜ ๊ฒฝ์šฐ ๋‹ค์Œ๊ณผ ๊ฐ™์ด location ์— HTTP 301 Response์™€ ํ•จ๊ป˜ HTTPS URL ์„ ์ง€์ •ํ•˜๋ฉด ์• ํ”Œ๋ฆฌ์ผ€์ด์…˜ ์ˆ˜์ •์—†์ด ๋ชจ๋“  ํŽ˜์ด์ง€๋ฅผ HTTPS ๋กœ ์ œ๊ณตํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค.

server {
    listen       80;
    server_name  myserver.com;
    location / {
	    return 301 https://myserver.com$request_uri;
	}
}

ย 

๋งŒ์•ฝ ์›น ์„œ๋ฒ„์˜ ์„ค์ •์„ ์ˆ˜์ •ํ•  ์ˆ˜ ์—†๊ฑฐ๋‚˜ HTTP ์™€ HTTPS ๋ฅผ ์„ž์–ด์„œ ์ œ๊ณตํ•ด์•ผ ํ•œ๋‹ค๋ฉด ๋ผ๋ผ๋ฒจ์˜ ๋ฏธ๋“ค์›จ์–ด ๊ธฐ๋Šฅ์„ ์‚ฌ์šฉํ•˜๋ฉด ์• ํ”Œ๋ฆฌ์ผ€์ด์…˜ ์ˆ˜์ •์„ ์ตœ์†Œํ™”ํ•˜๋ฉด์„œ ์†์‰ฝ๊ฒŒ HTTPS ๋กœ ์„œ๋น„์Šค๋ฅผ ์ œ๊ณตํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค.

ย 

๋ฏธ๋“ค์›จ์–ด ์ƒ์„ฑ

artisan ์˜ make ์˜ ํ•˜์œ„ ์˜ต์…˜์ค‘์—๋Š” ย ๋ฏธ๋“ค์›จ์–ด๋ฅผ ์ƒ์„ฑํ•˜๋Š” ์˜ต์…˜์ด ์žˆ์œผ๋ฉฐ ํŒŒ๋ผ๋ฏธํ„ฐ๋Š” ๋ฏธ๋“ค์›จ์–ด์˜ ์ด๋ฆ„์ž…๋‹ˆ๋‹ค. ๊ฐ•์ œ๋กœ ย HTTPS ๋กœ ์ „ํ™˜ํ•˜๋Š” ์—ญํ• ์„ ์ˆ˜ํ–‰ํ•˜๋ฏ€๋กœ ๋ฏธ๋“ค์›จ์–ด์˜ ์ด๋ฆ„์€ ForceHttps ๋กœ ๋ช…๋ช…ํ•˜์—ฌ ์ƒ์„ฑํ•ฉ๋‹ˆ๋‹ค.

$ php artisan make:middleware ForceHttps 

ย 

๋ฏธ๋“ค์›จ์–ด๋Š”ย app\Http\Middleware\ ํด๋”๋‚ด์— ๋ฏธ๋“ค์›จ์–ด.php ํŒŒ์ผ๋กœ ์ƒ์„ฑ๋˜๋ฉฐ ์œ„์—์„œ ForceHttps ๋ฅผ ๋ฏธ๋“ค์›จ์–ด ์ด๋ฆ„์œผ๋กœ ์ฃผ์—ˆ์œผ๋ฏ€๋กœย app\Http\Middleware\ForceHttps.php ํŒŒ์ผ์ด ์ƒ์„ฑ๋ฉ๋‹ˆ๋‹ค.

์ด์ œ ๋ฏธ๋“ค์›จ์–ด ํŒŒ์ผ์„ ์—ด๊ณ  ๋‹ค์Œ๊ณผ ๊ฐ™์ด ์ฝ”๋”ฉํ•ฉ๋‹ˆ๋‹ค.

<?php
namespace App\Http\Middleware;
use Closure;
class ForceHttps 
{
    // HTTPS ๋กœ ์ œ๊ณตํ•˜์ง€ ์•Š์„ URI. legacy ๋กœ ์‹œ์ž‘๋˜๋Š” URI ์ผ ๊ฒฝ์šฐ SSL ์„ ๊ฐ•์ œ ์ ์šฉํ•˜์ง€ ์•Š์Œ
    protected $except = [
        'legacy/*',
    ];
    // HTTPS ๋กœ ์ œ๊ณตํ•˜์ง€ ์•Š์„ ์• ํ”Œ๋ฆฌ์ผ€์ด์…˜ ํ™˜๊ฒฝ. ๊ฐœ๋ฐœ์ž PC ์—์„œ ๊ตฌ๋™(local)ํ•  ๊ฒฝ์šฐ์™€ PHPUnit ์„ ๊ตฌ๋™(testing)ํ•  ๊ฒฝ์šฐ๋Š” ๊ฐ•์ œ Https ๋ฅผ ์‚ฌ์šฉํ•˜์ง€ ์•Š์Œ
    protected $exceptEnv = [
        'local',
        'testing',
    ];
    /**
     * Handle an incoming request.
     *
     * @param  \Illuminate\Http\Request  $request
     * @param  \Closure  $next
     * @return mixed
     */
    public function handle($request, Closure $next)
    {
		// Https ๊ฐ€ ์•„๋‹ˆ๊ณ  ์ œ์™ธ๋˜๋Š” ์กฐ๊ฑด์ด ์•„๋‹ ๊ฒฝ์šฐ ๊ฐ•์ œ๋กœ HTTPS ๋กœ ํฌ์›Œ๋”ฉ
         if (!$request->secure() && !$this->shouldPassThrough($request) && !$this->envPassThrough()) {
            
            return redirect()->secure($request->getRequestUri());
        }
        return $next($request);
    }
ย 
	// ์ œ์™ธํ•  URI ์ธ์ง€ ํ™•์ธ
    protected function shouldPassThrough($request)
    {
        foreach ($this->except as $except) {
            if ($request->is($except)) {
                return true;
            }
        }
     
        return false;
    }
ย 
	// ์ œ์™ธํ•  ํ™˜๊ฒฝ์ธ์ง€ ํ™•์ธ
    protected function envPassThrough() 
    {
        $appEnv = \App::environment();
        foreach ($this->exceptEnv as $except) {
            if ($appEnv === $except)
                return true;
        }
        return false;  
    }
}

ย 

์ด์ œ ์ƒ์„ฑํ•œ ๋ฏธ๋“ค์›จ์–ด๋Š”ย app/Http/Kernel.php์— ๋“ฑ๋กํ•˜๋ฉด ๋˜๋ฉฐ ๋ผ๋ผ๋ฒจ์—์„œ๋Š” ๋‘ ๊ฐ€์ง€ ๋ฐฉ์‹์˜ ๋ฏธ๋“ค์›จ์–ด๊ฐ€ ์žˆ์Šต๋‹ˆ๋‹ค.

ย 

์ „์—ญ ๋ฏธ๋“ค์›จ์–ด(Global Middleware)

์ „์—ญ ๋ฏธ๋“ค์›จ์–ด๋Š” ๋ชจ๋“  Request ๋งˆ๋‹ค ํ˜ธ์ถœ๋˜๋Š” ๋ฏธ๋“ค์›จ์–ด๋กœ ํ˜ธ์ถœ์˜ ์˜ค๋ฒ„ํ—ค๋“œ๊ฐ€ ์žˆ์ง€๋งŒ ๊ฐœ๋ณ„ ๋ผ์šฐํŠธ์—๋Š” ๋“ฑ๋กํ•˜์ง€ ์•Š์•„๋„ ๋˜๋Š” ์žฅ์ ์ด ์žˆ์œผ๋ฉฐ ๊ธฐ๋ณธ ํƒ‘์žฌ๋œ ์ „์—ญ ๋ฏธ๋“ค์›จ์–ด๋กœ๋Š” ์• ํ”Œ๋ฆฌ์ผ€์ด์…˜์ด ์œ ์ง€๋ณด์ˆ˜ ์ƒํƒœ์ธ์ง€ ํ™•์ธํ•˜๋Š”ย CheckForMaintenanceMode ์™€ Csrf ํ† ํฐ์„ ๊ฒ€์ฆํ•˜๋Š”ย VerifyCsrfToken, ์ฟ ํ‚ค๋ฅผ ์•”ํ˜ธํ™”ํ•˜๋Š” EncryptCookies ๋“ฑ์ด ์žˆ์Šต๋‹ˆ๋‹ค.

ย 

๋‹ค์Œ์€ ForceHttps ๋ฏธ๋“ค์›จ์–ด๋ฅผ ์ „์—ญ ๋ฏธ๋“ค์›จ์–ด๋กœ ๋“ฑ๋กํ•˜๋Š” ์˜ˆ์ œ์ž…๋‹ˆ๋‹ค.

protected $middleware = [
        \Illuminate\Foundation\Http\Middleware\CheckForMaintenanceMode::class,
        \App\Http\Middleware\EncryptCookies::class,
        \Illuminate\Cookie\Middleware\AddQueuedCookiesToResponse::class,
        \Illuminate\Session\Middleware\StartSession::class,
        \Illuminate\View\Middleware\ShareErrorsFromSession::class,
        \App\Http\Middleware\VerifyCsrfToken::class,
		\App\Http\Middleware\ForceHttps::class, // ๋ชจ๋“  ์ปจํ…์ธ ์— ๋Œ€ํ•ด Https ๋กœ ์ œ๊ณต
    ];

ย 

๋ผ์šฐํŠธ ๋ฏธ๋“ค์›จ์–ด(Route Middleware)

๋ผ์šฐํŠธ ๋ฏธ๋“ค์›จ์–ด๋กœ ๋“ฑ๋กํ•˜๋ ค๋ฉด ์•„๋ž˜์™€ ๊ฐ™์ด $routeMiddleware ๋ฐฐ์—ด์— ํ‚ค๋กœ ๋ฏธ๋“ค์›จ์–ด์˜ ๋ณ„๋ช…์„, ๊ฐ’์—๋Š” ๋ฏธ๋“ค์›จ์–ด ํด๋ž˜์Šค๋ฅผ ์ ์–ด์ฃผ๋ฉด ๋ฉ๋‹ˆ๋‹ค.

๋ผ์šฐํŠธ ๋ฏธ๋“ค์›จ์–ด๋Š” HTTP์™€ HTTPS ๋ฅผ ํ˜ผ์šฉํ•ด์„œ ์‚ฌ์šฉํ•ด์•ผ ํ•  ๊ฒฝ์šฐ์— ๋ผ์šฐํŠธ ๋ณ„๋กœ https ์‚ฌ์šฉ ์—ฌ๋ถ€๋ฅผ ์„ค์ •ํ•  ์ˆ˜ ์žˆ์œผ๋ฏ€๋กœ ์œ ์šฉํ•ฉ๋‹ˆ๋‹ค.

protected $routeMiddleware = [
        'auth' => \App\Http\Middleware\Authenticate::class,
        'auth.basic' => \Illuminate\Auth\Middleware\AuthenticateWithBasicAuth::class,
        'guest' => \App\Http\Middleware\RedirectIfAuthenticated::class,
        'force.https' => \App\Http\Middleware\ForceHttps::class,
    ];

ย 

ย 

์ด์ œ ๋ผ์šฐํŠธ ์„ค์ •์— ๋‹ค์Œ๊ณผ ๊ฐ™์ด middelware ๋ผ๋Š” ํ‚ค์— ๋ฏธ๋“ค์›จ์–ด ์ด๋ฆ„(force.https)๋ฅผ ์‚ฌ์šฉํ•˜์—ฌ https ์‚ฌ์šฉ ์—ฌ๋ถ€๋ฅผ ์„ค์ •ํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค.

//Route::get('auth/login', 'Auth\AuthController@getLogin');
// https ๋ฏธ๋“ค์›จ์–ด ์ ์šฉ
Route::get('auth/login',['middleware' => 'force.https', 'as' => 'auth.login', 'uses' => 'Auth\AuthController@getLogin']);

ย 

๋งŒ์•ฝ ์—ฌ๋Ÿฌ ๊ฐœ์˜ ๋ฏธ๋“ค์›จ์–ด๋ฅผ ์‚ฌ์šฉํ•œ๋‹ค๋ฉด ๋‹ค์Œ๊ณผ ๊ฐ™์ด ์‚ฌ์šฉํ•  ๋ฏธ๋“ค์›จ์–ด ์ด๋ฆ„์„ ๋ฐฐ์—ด๋กœ ๋„˜๊ฒจ์ฃผ๋ฉด ๋ฉ๋‹ˆ๋‹ค.

Route::get('admin/profile', ['middleware' => ['force.https', 'auth', ], function () {
    return view('profile.edit');
}]);

๋ผ์šฐํŠธ ๋ฏธ๋“ค์›จ์–ด๋กœ ๋“ฑ๋กํ•  ๊ฒฝ์šฐ auth ๋ฏธ๋“ค์›จ์–ด๋ณด๋‹ค force.https ๋ฅผ ๋จผ์ € ์ ์–ด ์ฃผ์–ด์„œ ๋จผ์ € ํ˜ธ์ถœ๋˜๋„๋ก ํ•ด์•ผ ํ•ฉ๋‹ˆ๋‹ค. auth ๋ฅผ ๋จผ์ € ์ ์œผ๋ฉด http ๋กœ ์ธ์ฆ์ด ์ด๋ฃจ์–ด์ง„ ํ›„์— https ๋กœ ์ „ํ™˜์ด ๋˜๋ฏ€๋กœ ๋กœ๊ทธ์ธ ์ •๋ณด ๋ณดํ˜ธ๊ฐ€ ์ œ๋Œ€๋กœ ๋˜์ง€ ์•Š์Šต๋‹ˆ๋‹ค.

ย 

ย