2017 © Pedro Peláez
 

library csp

Implementation of Content Security Policy (CSP) nonce-source

image

kenjis/csp

Implementation of Content Security Policy (CSP) nonce-source

  • Wednesday, November 12, 2014
  • by kenjis
  • Repository
  • 1 Watchers
  • 3 Stars
  • 290 Installations
  • PHP
  • 0 Dependents
  • 0 Suggesters
  • 0 Forks
  • 2 Open issues
  • 1 Versions
  • 27 % Grown

The README.md

CSP nonce-source for PHP

Build Status Code Coverage Scrutinizer Code Quality, (*1)

CSP (Content Security Policy) nonce-source library for PHP., (*2)

What is CSP nonce-source?

It is one of CSP 2 features to prevent XSS., (*3)

If you don't know, please see CSP for the web we have | Mozilla Security Blog., (*4)

Requirement

  • PHP 5.4 or lator

Installation

$ git clone https://github.com/kenjis/php-csp-nonce-source.git
$ cd php-csp-nonce-source
$ composer install

Usage

All you have to call is only Csp::sendHeader() and Csp::getNonce()., (*5)

Csp::sendHeader() sends CSP header., (*6)

Csp::getNonce() returns nonce value., (*7)


<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<title>Sample of CSP nonce-source</title>
</head>
<body>













</body>
</html>

You can test it with PHP built-in web server., (*8)

$ php -S localhost:8000

And browse http://localhost:8000/., (*9)

You can see CSP violation report in csp-report.log file., (*10)

(Optional) Add other polices

You can add other polices using Csp::addPolicy()., (*11)

<?php
require __DIR__ . '/bootstrap.php';
Csp::addPolicy('default-src', 'self');
Csp::addPolicy('img-src', 'img.example.com');
Csp::sendHeader();

(Optional) Report Only

You can set Report Only Mode using Csp::setReportOnly()., (*12)

<?php
require __DIR__ . '/bootstrap.php';
Csp::addPolicy('default-src', 'self');
Csp::setReportOnly();
Csp::sendHeader();

You can see CSP violation report in csp-report.log file., (*13)

License

MIT License. See LICENSE.md., (*14)

Reference

  • Content Security Policy Level 2 http://www.w3.org/TR/2014/WD-CSP2-20140703/
  • Firefox Notes Version 31.0 https://www.mozilla.org/en-US/mobile/31.0/releasenotes/
  • CSP for the web we have | Mozilla Security Blog https://blog.mozilla.org/security/2014/10/04/csp-for-the-web-we-have/

The Versions

12/11 2014

dev-master

9999999-dev

Implementation of Content Security Policy (CSP) nonce-source

  Sources   Download

MIT

The Requires

 

The Development Requires

by Kenji Suzuki

security xss csp content security policy nonce-source