2017 © Pedro Peláez
 

library csp-middleware

Add Content-Security-Policy headers for PSR-7 requests. Uses the csp-builder library paragonie/csp-builder.

image

pavlakis/csp-middleware

Add Content-Security-Policy headers for PSR-7 requests. Uses the csp-builder library paragonie/csp-builder.

  • Wednesday, May 17, 2017
  • by pavlakis
  • Repository
  • 1 Watchers
  • 2 Stars
  • 77 Installations
  • PHP
  • 0 Dependents
  • 0 Suggesters
  • 2 Forks
  • 0 Open issues
  • 3 Versions
  • 0 % Grown

The README.md

Build Status Total Downloads Latest Stable Version codecov, (*1)

CSP Middleware

Add Content-Security-Policy headers using PSR-7 requests. Uses the paragonie/csp-builder package., (*2)

Usage

Adding the middleware is as simple as:, (*3)


$app->add(new \Pavlakis\Middleware\Csp\CspMiddleware($container->get('csp'));

Where $container->get('csp') returns an instance of CSPBuilder with a CSP configuration., (*4)

There is a second parameter $reportOnly. It is a boolean and set to true by default and it will add the CSP header as Content-Security-Policy-Report-Only. This is important so you don't break your application accidentally., (*5)

To enable it, pass false, (*6)

Use a json file with the csp policies., (*7)

Example:, (*8)

{
  "report-only": false,
  "report-uri": "/csp/enforce",
  "base-uri": [],
  "default-src": [],
  "child-src": {
    "self": false
  },
  "connect-src": {},
  "font-src": {
    "self": true
  },
  "form-action": {
    "self": true
  },
  "frame-ancestors": [],
  "img-src": {
    "self": true
  },
  "media-src": [],
  "object-src": [],
  "plugin-types": [],
  "script-src": {
    "allow": [
      "https://www.google-analytics.com"
    ],
    "self": true,
    "unsafe-inline": false,
    "unsafe-eval": false
  },
  "style-src": {
    "self": true,
    "unsafe-inline": false
  },
  "upgrade-insecure-requests": true
}

Example in Slim3

Dependencies (dependencies.php), (*9)


$container['csp'] = function ($c) {
    $csp = CSPBuilder::fromFile(__DIR__ . '/configs/csp.json');
    return $csp;
};

Application Middleware (middleware.php), (*10)


$app->add(new \Pavlakis\Middleware\Csp\CspMiddleware($container->get('csp'));

Resources

Useful resources for CSP, (*11)

The Versions

17/05 2017

dev-master

9999999-dev http://github.com/pavlakis/csp-middleware

Add Content-Security-Policy headers for PSR-7 requests. Uses the csp-builder library paragonie/csp-builder.

  Sources   Download

MIT

The Requires

 

The Development Requires

by Adoni Pavlakis

middleware security csp header content security policy

17/05 2017

0.2

0.2.0.0 http://github.com/pavlakis/csp-middleware

Add Content-Security-Policy headers for PSR-7 requests. Uses the csp-builder library paragonie/csp-builder.

  Sources   Download

MIT

The Requires

 

The Development Requires

by Adoni Pavlakis

middleware security csp header content security policy

29/04 2017

0.1

0.1.0.0 http://github.com/pavlakis/csp-middleware

Add Content-Security-Policy headers for PSR-7 requests. Uses the csp-builder library paragonie/csp-builder.

  Sources   Download

MIT

The Requires

 

The Development Requires

by Adoni Pavlakis

middleware security csp header content security policy