LoopbackOnlyMiddleware
The panel's default gate: only requests from the loopback interface get through. A fresh app has no identity wired, and an admin panel with no gate at all is a door left open. This is the posture until the app declares `admin.middleware` — a list of PSR-15 middleware the panel attaches to every one of its routes, where a passkey or scope gate takes this one's place. Fails closed: no remote address means no answer.
LoopbackOnlyMiddleware::__construct()
public function __construct(Milpa\Admin\I18n\Catalog $catalog = new Catalog()):Parameters
| Name | Type | Description |
|---|---|---|
| $catalog | Milpa\Admin\I18n\Catalog |
LoopbackOnlyMiddleware::process()
public function process(Psr\Http\Message\ServerRequestInterface $request, Psr\Http\Server\RequestHandlerInterface $handler): Psr\Http\Message\ResponseInterfaceLets a loopback request through and answers 403 to everything else.
Parameters
| Name | Type | Description |
|---|---|---|
| $request | Psr\Http\Message\ServerRequestInterface | |
| $handler | Psr\Http\Server\RequestHandlerInterface |
LoopbackOnlyMiddleware::isLoopback()
public static function isLoopback(string $address): boolTrue for IPv4 127.0.0.0/8 and IPv6 ::1 (also in its IPv4-mapped form).
Parameters
| Name | Type | Description |
|---|---|---|
| $address | string |