KoPKB/My-KOPKB
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects 1 Releases Wiki Activity

first init

Browse Source
This commit is contained in:
ISMAIL MASSERAN
2026-06-08 11:37:14 +08:00
commit 94ecbe5887
1058 changed files with 87732 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
be/config/api_security.php
+167
View File
@@ -0,0 +1,167 @@
<?php
return [
/*
|--------------------------------------------------------------------------
| API Security Configuration
|--------------------------------------------------------------------------
|
| This configuration controls API security settings for production
| environments, including blocking API testing tools.
|
*/
/*
|--------------------------------------------------------------------------
| Block API Tools in Production
|--------------------------------------------------------------------------
|
| When enabled, this will block common API testing tools like Postman,
| Insomnia, curl, etc. from accessing the API in production environment.
|
*/
'block_api_tools_in_production' => env('BLOCK_API_TOOLS_IN_PRODUCTION', true),
/*
|--------------------------------------------------------------------------
| Enable API Key Authentication
|--------------------------------------------------------------------------
|
| When enabled, external systems can use API keys to bypass API tool
| blocking and access protected endpoints.
|
*/
'enable_api_key_auth' => env('ENABLE_API_KEY_AUTH', true),
/*
|--------------------------------------------------------------------------
| Blocked User Agents
|--------------------------------------------------------------------------
|
| List of User-Agent strings that should be blocked in production.
| These are common API testing tools and clients.
|
*/
'blocked_user_agents' => [
'insomnia',
'postman',
'postmanruntime',
'curl',
'wget',
'httpie',
'restclient',
'apifox',
'thunder client',
'rapidapi',
'swagger',
'openapi',
'api tester',
'api client',
'rest client',
'http client',
'api explorer',
'api documentation',
'soapui',
'jmeter',
'newman',
'paw',
'charles',
'fiddler',
'burp',
'zap',
'mitmproxy',
],
/*
|--------------------------------------------------------------------------
| Minimum User-Agent Length
|--------------------------------------------------------------------------
|
| Minimum length for User-Agent strings. Shorter strings are considered
| suspicious and will be blocked.
|
*/
'min_user_agent_length' => env('MIN_USER_AGENT_LENGTH', 10),
/*
|--------------------------------------------------------------------------
| Custom Error Message
|--------------------------------------------------------------------------
|
| Custom error message to display when API tools are blocked.
|
*/
'blocked_message' => env('API_BLOCKED_MESSAGE', 'API access is restricted in production environment. Please use the web interface.'),
/*
|--------------------------------------------------------------------------
| Allowed IP Addresses
|--------------------------------------------------------------------------
|
| List of IP addresses that are allowed to bypass API tool blocking.
| Useful for monitoring tools or legitimate API clients.
|
*/
'allowed_ips' => array_filter(explode(',', env('API_ALLOWED_IPS', ''))),
/*
|--------------------------------------------------------------------------
| Allowed User Agents
|--------------------------------------------------------------------------
|
| List of User-Agent patterns that are allowed even if they match
| blocked patterns. Useful for legitimate monitoring tools.
|
*/
'allowed_user_agents' => array_filter(explode(',', env('API_ALLOWED_USER_AGENTS', ''))),
/*
|--------------------------------------------------------------------------
| Valid API Keys
|--------------------------------------------------------------------------
|
| List of valid API keys for external system access. These keys allow
| external systems to bypass API tool blocking when making requests.
|
| Format: Comma-separated list of API keys
| Example: API_VALID_KEYS=key1,key2,key3
|
*/
'valid_api_keys' => array_filter(explode(',', env('API_VALID_KEYS', ''))),
/*
|--------------------------------------------------------------------------
| API Key Header Names
|--------------------------------------------------------------------------
|
| List of header names that can contain API keys. The middleware will
| check these headers for valid API keys.
|
*/
'api_key_headers' => [
'X-API-Key',
'API-Key',
'Authorization', // Bearer token format
],
/*
|--------------------------------------------------------------------------
| API Key Logging
|--------------------------------------------------------------------------
|
| Whether to log API key usage for monitoring and security purposes.
| When enabled, logs will include API key usage (without exposing the key).
|
*/
'log_api_key_usage' => env('API_LOG_KEY_USAGE', true),
];