3
The $_SERVER['REMOTE_ADDR'] can be trusted. This is the source address of the TCP connection to the server, it is not taken from headers that are sent by the client as is the case with some of the other $_SERVER variables.
2
This is an undefined header.
As such, how browsers react to it is browser-dependent. It is possible, but very unlikely, that they will still interpret the header correctly. However, I would not bet on it.
Instead, change the header from Strict-TransportSecurity to Strict-Transport-Security.
2
... but it contradicts advice found in stack exchange sites.
First, the question you refer to has actually two answers. One which advises against returning an error and the other finding it a reasonable approach. And the votes for both answers are similar, so I would not treat any of these as a clear recommendation. What is the accepted answer is only the ...
1
The first answer by Schwern makes the argument that .ENV variables are fine and
".ENV is a convenience and, ideally, is not used in production"
Before that line, you skipped this line:
To clarify, the security and flexibility are gained by putting secrets into environment variables.
If you're not comfortable using .ENV, then just pass the ...
Only top voted, non community-wiki answers of a minimum length are eligible
