Routing based on header value

[nagi1]

Hey awesome people,

Is there any method or way to achieve this kind of routing?

I'm welling to contribute this as my first contribution.

[dennisprudlo]

As I understand you want to allow access to the routes only if a special header is set? In this case you can create a HasHeader-Middleware where you check if the request contains the header (and has the correct value). But a routing helper for this kind of middleware does not exist.

[nagi1]

I know, it'll be a nice to have "Quality of life feature".

What do you think?

[dennisprudlo]

I personally never needed it and if I did I probably would create a middleware so I could define routes like so:

Route::post('files/123/contents/', SomeController::class)->middleware('header:X-VALUE,🔥🔥🔥');

But recently in #39464 the Authorize middleware got its own function (its a very frequently used middleware, there's that). So give it a try.

[nagi1]

You were as helpful as a bottle of water in the middle of the desert!

[nagi1]

check if the request contains the header (and has the correct value).

I'm a bit confused about middleware

        foreach($headers as $header) {
        
            if(!$request->hasHeader($header)) {
              // what will goes here
              // is it return $next($request);
            }
            
            // what will goes here too?
        }

[dennisprudlo]

When a request comes in laravel creates a list of middlewares your request must pass through before it reaches your controller. Each middleware can do something to/with the request. The $next closure passes the request to the next middleware in that list. So when you are done in your middleware you can give the request to the next middleware using $next($request).

But you want to abort or redirect if the header is not present. So the middleware should look like this:

public function handle(Request $request, Closure $next)
{
    $headers = [ ... ];
    foreach ($headers as $header) {
        if (! $request->hasHeader($header)) {
            abort(403, 'Missing required headers');
        }
    }

    return $next($request);
}

When any of the headers is not present a 403 error message will be shown. You can of course use a different status code, or trigger a redirect to another page. It's up to you.