如何阻止Postman、cURL等HTTPS客户端访问Laravel站点？

当前你的Cors中间件拦截逻辑存在局限：仅通过HTTP_POSTMAN_TOKEN头识别Postman，但该请求头可被手动移除，且cURL等工具默认不会发送此头，导致拦截失效。以下是几种可行的改进方案：

方案1：通过User-Agent识别拦截 #

大多数非浏览器客户端会带有特征性的User-Agent，可据此拦截：

public function handle($request, Closure $next)
{
    $blockedAgents = ['PostmanRuntime', 'curl', 'Wget'];
    $userAgent = $request->server->get('HTTP_USER_AGENT', '');
    
    foreach ($blockedAgents as $agent) {
        if (str_contains(strtolower($userAgent), strtolower($agent))) {
            abort(403, 'Access denied');
        }
    }

    return $next($request)
        ->header('Access-Control-Allow-Origin', 'https://yourdomain.com')
        ->header('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, OPTIONS')
        ->header('Access-Control-Allow-Headers', 'X-Requested-With, Content-Type, X-Token-Auth, Authorization');
}

方案2：验证Origin请求头（更可靠） #

浏览器发起合法跨域请求时会自动携带Origin头，而Postman/cURL默认不会发送该头（除非手动伪造）。可通过限制仅允许指定Origin来拦截非浏览器请求：

public function handle($request, Closure $next)
{
    $allowedOrigins = ['https://yourdomain.com'];
    $origin = $request->server->get('HTTP_ORIGIN');
    
    // 无Origin头或不在允许列表内则拦截
    if (!$origin || !in_array($origin, $allowedOrigins)) {
        abort(403, 'Access denied');
    }

    return $next($request)
        ->header('Access-Control-Allow-Origin', $origin)
        ->header('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, OPTIONS')
        ->header('Access-Control-Allow-Headers', 'X-Requested-With, Content-Type, X-Token-Auth, Authorization');
}

方案3：组合多种校验方式（更严谨） #

同时结合User-Agent和Origin校验，提升拦截准确性：

public function handle($request, Closure $next)
{
    $allowedOrigins = ['https://yourdomain.com'];
    $blockedAgents = ['PostmanRuntime', 'curl', 'Wget'];
    
    $origin = $request->server->get('HTTP_ORIGIN');
    $userAgent = $request->server->get('HTTP_USER_AGENT', '');

    // 校验Origin
    if (!$origin || !in_array($origin, $allowedOrigins)) {
        abort(403, 'Access denied');
    }

    // 校验User-Agent
    foreach ($blockedAgents as $agent) {
        if (str_contains(strtolower($userAgent), strtolower($agent))) {
            abort(403, 'Access denied');
        }
    }

    return $next($request)
        ->header('Access-Control-Allow-Origin', $origin)
        ->header('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, OPTIONS')
        ->header('Access-Control-Allow-Headers', 'X-Requested-With, Content-Type, X-Token-Auth, Authorization');
}

注意事项 #

• 上述方式无法完全避免请求伪造（比如手动设置合法Origin和User-Agent），若需保护敏感接口，建议额外添加API密钥验证或会话校验。
• 确保中间件已正确注册到路由中，可在app/Http/Kernel.php的$middleware或$middlewareGroups里添加该Cors中间件。

内容的提问来源于stack exchange，提问作者Sohang Tyagi