mirror of
https://github.com/projectsend/projectsend.git
synced 2026-09-11 22:38:54 +00:00
ignacionelson
6e47d76ba6
Client file sharing, rebuilt from the ground up: a private area per client, resumable uploads, folders, groups and categories, sharing with expiry dates and download limits, comments, file versions, an activity log, a REST API, and sixteen languages. This repository begins here. ProjectSend 2 was developed privately, and that development history is not published — the previous generation remains available, with its own history, at projectsend/legacy. Free software under the GNU General Public License v2, or (at your option) any later version.
90 lines
3.3 KiB
PHP
90 lines
3.3 KiB
PHP
<?php
|
|
|
|
use Illuminate\Cookie\Middleware\EncryptCookies;
|
|
use Illuminate\Foundation\Http\Middleware\ValidateCsrfToken;
|
|
use Laravel\Sanctum\Http\Middleware\AuthenticateSession;
|
|
|
|
return [
|
|
|
|
/*
|
|
|--------------------------------------------------------------------------
|
|
| Stateful Domains
|
|
|--------------------------------------------------------------------------
|
|
|
|
|
| Deliberately empty: this application's API is bearer-token only. The
|
|
| React/Inertia frontend keeps authenticating with its session cookie over
|
|
| the `web` routes and never calls /api/*.
|
|
|
|
|
| Naming a domain here would hand every browser session an authenticated,
|
|
| cookie-carried path into the API — which means any XSS in the SPA could
|
|
| drive the whole API as the logged-in user, and it would drag CSRF back
|
|
| into scope for routes that have no CSRF protection. The API surface is
|
|
| small precisely so it can stay reachable only by a credential someone
|
|
| deliberately minted. Do not populate this without revisiting that.
|
|
|
|
|
*/
|
|
|
|
'stateful' => [],
|
|
|
|
/*
|
|
|--------------------------------------------------------------------------
|
|
| Sanctum Guards
|
|
|--------------------------------------------------------------------------
|
|
|
|
|
| Empty for the same reason, and it is the load-bearing half: with a guard
|
|
| listed here, Sanctum answers an API request from whatever first-party
|
|
| session it can find before it ever looks for a bearer token. Empty means
|
|
| there is exactly one way to authenticate against /api/* — a token.
|
|
|
|
|
*/
|
|
|
|
'guard' => [],
|
|
|
|
/*
|
|
|--------------------------------------------------------------------------
|
|
| Expiration Minutes
|
|
|--------------------------------------------------------------------------
|
|
|
|
|
| Null on purpose: expiry is per token, not global. Every token is issued
|
|
| with its own `expires_at` (required at creation, see ApiTokensController)
|
|
| so a caller can choose a short-lived token without shortening everyone
|
|
| else's. A value here would silently override those per-token dates.
|
|
|
|
|
*/
|
|
|
|
'expiration' => null,
|
|
|
|
/*
|
|
|--------------------------------------------------------------------------
|
|
| Token Prefix
|
|
|--------------------------------------------------------------------------
|
|
|
|
|
| A fixed, recognisable prefix so a leaked token is findable: GitHub's
|
|
| secret scanning and most credential scanners key off exactly this kind
|
|
| of marker, and it makes an accidentally-committed token greppable.
|
|
|
|
|
| Changing this does not invalidate existing tokens — the prefix is part
|
|
| of the plaintext, not of the hash lookup.
|
|
|
|
|
*/
|
|
|
|
'token_prefix' => env('SANCTUM_TOKEN_PREFIX', 'psend_'),
|
|
|
|
/*
|
|
|--------------------------------------------------------------------------
|
|
| Sanctum Middleware
|
|
|--------------------------------------------------------------------------
|
|
|
|
|
| Unused while `stateful` is empty — kept at the package defaults so the
|
|
| file still matches upstream if statefulness is ever reconsidered.
|
|
|
|
|
*/
|
|
|
|
'middleware' => [
|
|
'authenticate_session' => AuthenticateSession::class,
|
|
'encrypt_cookies' => EncryptCookies::class,
|
|
'validate_csrf_token' => ValidateCsrfToken::class,
|
|
],
|
|
|
|
];
|