PHP code example of laikait / laika-shield

    
        
<?php
require_once('vendor/autoload.php');

/* Start to develop here. Best regards https://php-download.com/ */

    

laikait / laika-shield example snippets

use Laika\Shield\Pipeline\ShieldPipeline;

// In your pipeline registration
ShieldPipeline::class,

use Laika\Shield\ShieldConfig;
use Laika\Shield\Pipeline\ShieldPipeline;

// ShieldConfig is a singleton — configure it once and everything
// (ShieldPipeline, Shield::boot()) picks it up.
ShieldConfig::ip()->blocklist(['1.2.3.4', '10.0.0.0/8']);
ShieldConfig::rateLimit()->maxHits(30)->window(120);
ShieldConfig::xss()->skipKeys(['post_body']);
ShieldConfig::requestFilter()->

use Laika\Shield\Shield;
use Laika\Shield\ShieldConfig;

// Shield::boot() takes no arguments — it reads the shared ShieldConfig instance.
ShieldConfig::add('ip', ['blocklist' => ['1.2.3.4']]);
ShieldConfig::add('rate.limit', 'max.hits', 30);

Shield::boot();

// To run a DETACHED configuration instead — ShieldConfig::make() is not the
// shared instance, so boot() will not see it:
$config = ShieldConfig::make();
$config->ip->blocklist(['1.2.3.4']);

Shield::fromConfig($config)->run();

use Laika\Shield\Shield;

(new Shield())
    ->trustProxy(true, trustedProxies: ['10.0.0.0/8'])
    ->blockCountries('/path/to/GeoLite2-Country.mmdb', blocklist: ['CN', 'RU'])
    ->blockIps(['1.2.3.4', '10.10.0.0/16'])
    ->allowIps(['203.0.113.0/24'])
    ->tPatterns: ['/sqlmap/i', '/nikto/i'],
    )
    ->run();

// ── Top level (instance only — see the note below) ───────────────────────
ShieldConfig::instance()->trustProxy(false);      // consult proxy headers at all
ShieldConfig::instance()->trustedProxies([]);     // CIDRs of YOUR proxies
ShieldConfig::instance()->ipVersion(null);        // 4, 6, or null for both

// ── IP filtering ─────────────────────────────────────────────────────────
ShieldConfig::ip()->blocklist([]);           // denied IPs / CIDR ranges
ShieldConfig::ip()->allowlist([]);           // when non-empty, ONLY these are permitted

// ── Rate limiting ────────────────────────────────────────────────────────
ShieldConfig::rateLimit()->maxHits(60);      // requests per window, per IP
ShieldConfig::rateLimit()->window(60);       // window size in seconds
ShieldConfig::rateLimit()->storageDir(null); // null = system temp directory

// ── SQL injection detection ──────────────────────────────────────────────
ShieldConfig::sqlInjection()->skipKeys([]);  // input keys never scanned
ShieldConfig::sqlInjection()->scanBody(true);
ShieldConfig::sqlInjection()->strict(false); // see Tuning The Detectors

// ── XSS detection ────────────────────────────────────────────────────────
ShieldConfig::xss()->skipKeys([]);
ShieldConfig::xss()->scanBody(true);
ShieldConfig::xss()->scanHeaders(false);

// ── Request filtering ────────────────────────────────────────────────────
ShieldConfig::requestFilter()->blockedMethods(['TRACE', 'CONNECT']);
ShieldConfig::requestFilter()->blockedUriPatterns([]);
ShieldConfig::requestFilter()->blockedUserAgents(['/sqlmap/i', '/nikto/i', ...]);
ShieldConfig::requestFilter()->

ShieldConfig::rateLimit()->maxHits(30)->window(120);

$hits = ShieldConfig::rateLimit()->maxHits();   // 30

Shield::fromConfig([
    'request.filter' => ['content.length.max' => 2048],
])->run();
// blocked.methods is still ['TRACE', 'CONNECT']

ShieldConfig::rateLimit()->maxHits(30);
Shield::boot();                      // sees it

$config = ShieldConfig::make();
$config->rateLimit->maxHits(1);       // note: property, not ShieldConfig::rateLimit()

Shield::fromConfig($config)->run();   // only this sees it

use Laika\Shield\ShieldConfig;
use Laika\Shield\Shield;

// Top-level scalar
ShieldConfig::add('trust.proxy', true);

// Top-level array merge
ShieldConfig::add('ip', ['blocklist' => ['1.2.3.4', '10.0.0.0/8']]);

// Sub-key update (simplest way to change a nested value)
ShieldConfig::add('rate.limit', 'max.hits', 30);
ShieldConfig::add('sql.injection', 'skip.keys', ['password', 'token']);
ShieldConfig::add('xss', 'skip.keys', ['content', 'body']);
ShieldConfig::add('request.filter', 'content.length.max', 2048);

// Shield::boot() reads this shared instance
Shield::boot();

use Laika\Shield\Contract\RuleInterface;

class CountryBlockRule implements RuleInterface
{
    public function passes(): bool
    {
        // Your logic here
        return true;
    }

    public function message(): string
    {
        return 'Access Denied From Your Country.';
    }

    public function statusCode(): int
    {
        return 403;
    }

    public function additionalHeader(): void
    {
        return;
    }
}

// Register it
(new Shield())
    ->addRule(new CountryBlockRule())
    ->run();

use Laika\Shield\Support\IpHelper;

IpHelper::version('8.8.8.8');          // 4
IpHelper::version('2001:db8::1');      // 6
IpHelper::version('invalid');          // null

IpHelper::isV4('192.168.1.1');         // true
IpHelper::isV6('::1');                 // true
IpHelper::isPrivate('10.0.0.1');       // true
IpHelper::isLoopback('127.0.0.1');     // true
IpHelper::inCidr('192.168.1.5', '192.168.1.0/24'); // true

// Resolve real client IP (proxy-aware)
$ip = IpHelper::resolve(trustProxy: true, trustedProxies: ['10.0.0.0/8']);

'trust.proxy'     => true,
'trusted.proxies' => ['10.0.0.0/8', '173.245.48.0/20'],

'country' => [
    'db'        => '/var/lib/GeoIP/GeoLite2-Country.mmdb',
    'blocklist' => ['CN', 'RU'],
    'allowlist' => [],
],

'sql.injection' => [
    'skip.keys' => ['bio', 'comment'],  // never scanned
    'strict'    => false,               // recommended
],