Moved force https logic to a middleware; Changed default for config session.secure

app/Filament/Resources/UserResource.php

@@ -42,6 +42,7 @@ class UserResource extends Resource
     {
         /** @var User|null $record */
         $record = $form->getRecord();
+
         return $form
             ->columns(1)
             ->schema([

app/Http/Controllers/Web/HealthCheckController.php

@@ -64,6 +64,7 @@ class HealthCheckController extends Controller
             $response['app_env'] = app()->environment();
             $response['app_timezone'] = config('app.timezone');
             $response['app_force_https'] = config('app.force_https');
+            $response['session_secure'] = config('session.secure');
             $response['trusted_proxies'] = config('trustedproxy.proxies');
             $headers = $request->headers->all();
             if (isset($headers['cookie'])) {

app/Http/Kernel.php

@@ -18,7 +18,7 @@ class Kernel extends HttpKernel
      * @var array<int, class-string|string>
      */
     protected $middleware = [
-        // \App\Http\Middleware\TrustHosts::class,
+        \App\Http\Middleware\ForceHttps::class,
         \App\Http\Middleware\TrustProxies::class,
         \Illuminate\Http\Middleware\HandleCors::class,
         \App\Http\Middleware\PreventRequestsDuringMaintenance::class,

app/Http/Middleware/ForceHttps.php

@@ -0,0 +1,29 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Middleware;
+
+use Closure;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\URL;
+use Symfony\Component\HttpFoundation\Response;
+
+class ForceHttps
+{
+    /**
+     * Handle an incoming request.
+     *
+     * @param  \Closure(\Illuminate\Http\Request): (\Symfony\Component\HttpFoundation\Response)  $next
+     */
+    public function handle(Request $request, Closure $next, string ...$guards): Response
+    {
+        if (config('app.force_https', false)) {
+            URL::forceScheme('https');
+            $request->server->set('HTTPS', 'on');
+            $request->headers->set('X-Forwarded-Proto', 'https');
+        }
+
+        return $next($request);
+    }
+}

app/Http/Middleware/TrustHosts.php

@@ -1,22 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace App\Http\Middleware;
-
-use Illuminate\Http\Middleware\TrustHosts as Middleware;
-
-class TrustHosts extends Middleware
-{
-    /**
-     * Get the host patterns that should be trusted.
-     *
-     * @return array<int, string|null>
-     */
-    public function hosts(): array
-    {
-        return [
-            $this->allSubdomainsOfApplicationUrl(),
-        ];
-    }
-}

app/Providers/AppServiceProvider.php

@@ -29,7 +29,6 @@ use Illuminate\Database\Eloquent\Model;
 use Illuminate\Database\Eloquent\Relations\Relation;
 use Illuminate\Foundation\Application;
 use Illuminate\Support\Facades\Route;
-use Illuminate\Support\Facades\URL;
 use Illuminate\Support\ServiceProvider;
 
 class AppServiceProvider extends ServiceProvider
@@ -90,12 +89,6 @@ class AppServiceProvider extends ServiceProvider
             );
         });
 
-        if (config('app.force_https', false)) {
-            URL::forceScheme('https');
-            request()->server->set('HTTPS', 'on');
-            request()->headers->set('X-Forwarded-Proto', 'https');
-        }
-
         $this->app->scoped(PermissionStore::class, function (Application $app): PermissionStore {
             return new PermissionStore;
         });