Skip to content

feat: initial security middlewares (v0.1.0) - #1

Merged
code-cfernandes merged 2 commits into
mainfrom
feat/initial-implementation
Oct 10, 2026
Merged

code-cfernandes merged 2 commits into
mainfrom
feat/initial-implementation

Conversation

@code-cfernandes

Copy link
Copy Markdown
Member

PSR-15 security middlewares for PivotPHP and any PSR-15 pipeline.

  • CORS and trusted proxy: own implementation
  • Security headers (bepsvpt/secure-headers), CSRF (yiisoft/csrf), JWT (firebase/php-jwt), rate limit (symfony/rate-limiter): adapters, optional dependencies with version floors via conflict
  • Fail closed (401/403/429, handler never called); unsafe configuration rejected at construction
  • Addresses core SPECs 054, 055, 060, 063 (preflight), 064, 065, 067, 075

Verified locally: PHPUnit 86 tests on PHP 8.1 (lowest deps), 8.3 and 8.4 (highest); PHPStan level 9; PSR-12; composer audit clean.

🤖 Generated with Claude Code

code-cfernandes and others added 2 commits October 10, 2026 11:51
…F, JWT, rate limit)

PSR-15 middlewares that fail closed and validate their configuration at
construction. CORS and trusted proxies are implemented here; headers, CSRF,
JWT and rate limiting are adapters for bepsvpt/secure-headers, yiisoft/csrf,
firebase/php-jwt and symfony/rate-limiter (optional, version-floored via
conflict).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@code-cfernandes
code-cfernandes merged commit cd0126f into main Oct 10, 2026
3 checks passed
@code-cfernandes
code-cfernandes deleted the feat/initial-implementation branch October 10, 2026 14:53
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant