Configuration#

Every HELMET_ environment variable the package reads, its meaning, its default, and the file that reads it. The table below is generated from the code, so it cannot drift from what the package actually reads. To set a value, add it to your environment or .env; for how the platform presets choose the trusted proxies, see Platform presets.

How a value is read#

The Laravel adapter reads every value through Waynestate\Helmet\Support\Setting::get(). The real environment wins (getenv, then $_ENV, then $_SERVER); an empty string counts as not set, so a blank value falls through to the next source. When the environment has no value for the key, the private waynestate/playbook package (Playbook) supplies it, if it is installed. When neither has it, null comes back and the default in the table applies. Playbook is optional by design: the package never requires it, it only looks for the class. That is how a WSU value can arrive at an app without this public repo naming a single one of them.

Platform presets#

A preset names a platform's trusted-proxy list, so an app does not hard-code an address that belongs to the platform, not the app. The presets live in Waynestate\Helmet\Platform\Presets:

Laravel reads the preset from HELMET_PRESET (Playbook supplies it when the environment has none); an explicit HELMET_PROXIES always wins over the preset. Off the WSU platform, skip the preset and pass your own list of the addresses your front proxy connects from. An unknown preset name throws at boot, so a typo fails loudly instead of silently trusting nothing.

The variables#

Example .env#

HELMET_PRESET=citadel
HELMET_CSP_REPORT_URI=https://app.apps.wayne.edu/csp-report
HELMET_METRICS_ENABLED=true
HELMET_METRICS_TOKEN=change-me

Related#

• API
• Proof
• Install
• Platform presets
• WSU values (Playbook)