ISMAIL MASSERAN
168 lines
5.1 KiB
PHP
168 lines
5.1 KiB
PHP
<?php
|
|
|
|
return [
|
|
/*
|
|
|--------------------------------------------------------------------------
|
|
| API Security Configuration
|
|
|--------------------------------------------------------------------------
|
|
|
|
|
| This configuration controls API security settings for production
|
|
| environments, including blocking API testing tools.
|
|
|
|
|
*/
|
|
|
|
/*
|
|
|--------------------------------------------------------------------------
|
|
| Block API Tools in Production
|
|
|--------------------------------------------------------------------------
|
|
|
|
|
| When enabled, this will block common API testing tools like Postman,
|
|
| Insomnia, curl, etc. from accessing the API in production environment.
|
|
|
|
|
*/
|
|
|
|
'block_api_tools_in_production' => env('BLOCK_API_TOOLS_IN_PRODUCTION', true),
|
|
|
|
/*
|
|
|--------------------------------------------------------------------------
|
|
| Enable API Key Authentication
|
|
|--------------------------------------------------------------------------
|
|
|
|
|
| When enabled, external systems can use API keys to bypass API tool
|
|
| blocking and access protected endpoints.
|
|
|
|
|
*/
|
|
|
|
'enable_api_key_auth' => env('ENABLE_API_KEY_AUTH', true),
|
|
|
|
/*
|
|
|--------------------------------------------------------------------------
|
|
| Blocked User Agents
|
|
|--------------------------------------------------------------------------
|
|
|
|
|
| List of User-Agent strings that should be blocked in production.
|
|
| These are common API testing tools and clients.
|
|
|
|
|
*/
|
|
|
|
'blocked_user_agents' => [
|
|
'insomnia',
|
|
'postman',
|
|
'postmanruntime',
|
|
'curl',
|
|
'wget',
|
|
'httpie',
|
|
'restclient',
|
|
'apifox',
|
|
'thunder client',
|
|
'rapidapi',
|
|
'swagger',
|
|
'openapi',
|
|
'api tester',
|
|
'api client',
|
|
'rest client',
|
|
'http client',
|
|
'api explorer',
|
|
'api documentation',
|
|
'soapui',
|
|
'jmeter',
|
|
'newman',
|
|
'paw',
|
|
'charles',
|
|
'fiddler',
|
|
'burp',
|
|
'zap',
|
|
'mitmproxy',
|
|
],
|
|
|
|
/*
|
|
|--------------------------------------------------------------------------
|
|
| Minimum User-Agent Length
|
|
|--------------------------------------------------------------------------
|
|
|
|
|
| Minimum length for User-Agent strings. Shorter strings are considered
|
|
| suspicious and will be blocked.
|
|
|
|
|
*/
|
|
|
|
'min_user_agent_length' => env('MIN_USER_AGENT_LENGTH', 10),
|
|
|
|
/*
|
|
|--------------------------------------------------------------------------
|
|
| Custom Error Message
|
|
|--------------------------------------------------------------------------
|
|
|
|
|
| Custom error message to display when API tools are blocked.
|
|
|
|
|
*/
|
|
|
|
'blocked_message' => env('API_BLOCKED_MESSAGE', 'API access is restricted in production environment. Please use the web interface.'),
|
|
|
|
/*
|
|
|--------------------------------------------------------------------------
|
|
| Allowed IP Addresses
|
|
|--------------------------------------------------------------------------
|
|
|
|
|
| List of IP addresses that are allowed to bypass API tool blocking.
|
|
| Useful for monitoring tools or legitimate API clients.
|
|
|
|
|
*/
|
|
|
|
'allowed_ips' => array_filter(explode(',', env('API_ALLOWED_IPS', ''))),
|
|
|
|
/*
|
|
|--------------------------------------------------------------------------
|
|
| Allowed User Agents
|
|
|--------------------------------------------------------------------------
|
|
|
|
|
| List of User-Agent patterns that are allowed even if they match
|
|
| blocked patterns. Useful for legitimate monitoring tools.
|
|
|
|
|
*/
|
|
|
|
'allowed_user_agents' => array_filter(explode(',', env('API_ALLOWED_USER_AGENTS', ''))),
|
|
|
|
/*
|
|
|--------------------------------------------------------------------------
|
|
| Valid API Keys
|
|
|--------------------------------------------------------------------------
|
|
|
|
|
| List of valid API keys for external system access. These keys allow
|
|
| external systems to bypass API tool blocking when making requests.
|
|
|
|
|
| Format: Comma-separated list of API keys
|
|
| Example: API_VALID_KEYS=key1,key2,key3
|
|
|
|
|
*/
|
|
|
|
'valid_api_keys' => array_filter(explode(',', env('API_VALID_KEYS', ''))),
|
|
|
|
/*
|
|
|--------------------------------------------------------------------------
|
|
| API Key Header Names
|
|
|--------------------------------------------------------------------------
|
|
|
|
|
| List of header names that can contain API keys. The middleware will
|
|
| check these headers for valid API keys.
|
|
|
|
|
*/
|
|
|
|
'api_key_headers' => [
|
|
'X-API-Key',
|
|
'API-Key',
|
|
'Authorization', // Bearer token format
|
|
],
|
|
|
|
/*
|
|
|--------------------------------------------------------------------------
|
|
| API Key Logging
|
|
|--------------------------------------------------------------------------
|
|
|
|
|
| Whether to log API key usage for monitoring and security purposes.
|
|
| When enabled, logs will include API key usage (without exposing the key).
|
|
|
|
|
*/
|
|
|
|
'log_api_key_usage' => env('API_LOG_KEY_USAGE', true),
|
|
];
|