zae/content-security-policy

A really easy way to build CSP headers and add them to the response.

Content Security Policy

![Software License][ico-license] , _(*1)

A really easy way to build CSP headers and add them to the response., _(*2)

Officially supported platforms: - Laravel: ^5.8 - Craft: ^3.0, _(*3)

Install

Via Composer, _(*4)

bash $ composer require zae/content-security-policy, _(*5)

Laravel

Middleware

Add the middleware to the middleware Kernel., _(*6)

protected $middlewareGroups = [
    'web' => [
        ...
        \Zae\ContentSecurityPolicy\Laravel\Http\Middleware\ContentSecurityPolicy::class
    ],
]

Config (config/csp.php)

return [
    BlockAllMixedContent::class,
    Sandbox::class => [
        Sandbox::ALLOW_FORMS,
        Sandbox::ALLOW_SCRIPTS,
        Sandbox::ALLOW_TOP_NAVIGATION,
        Sandbox::ALLOW_SAME_ORIGIN,
        Sandbox::ALLOW_POPUPS,
    ]
];

Craft 3

The library includes a module for Craft 3 that can send the CSP header and a twig function to get the current CSP nonce., _(*7)

Register the module like this:, _(*8)

'modules' => [
    'csp' => \Zae\ContentSecurityPolicy\Craft\Module::class,
],
'bootstrap' => [
    'csp'
]

Use the twig functions like this:, _(*9)

<script nonce="{{ cspnonce() }}">
    // inline javascript
</script>

Config (config/csp.php)

return [
    'components' => [
        'builder' => Builder::class,
    ],
    'params' => [
        BlockAllMixedContent::class,
        Sandbox::class => [
            Sandbox::ALLOW_FORMS,
            Sandbox::ALLOW_SCRIPTS,
            Sandbox::ALLOW_TOP_NAVIGATION,
            Sandbox::ALLOW_SAME_ORIGIN,
            Sandbox::ALLOW_POPUPS,
        ]
    ]
];

Other

Although not officially supported yet, it's possible to use this library with other frameworks, an easy method is by using FluidDirectivesFactory., _(*10)

Fluid Factory

<?php
$csp = new CSP();
$factory = new FluidDirectivesFactory($csp);
$factory
    ->blockAllMixedContent()
    ->defaultSrc([
        Directive::SELF,
        'https:'
    ])
    ->baseUri([
        Directive::SELF
    ]);

Change log

Please see CHANGELOG for more information on what has changed recently., _(*11)

Contributing

Please see CONTRIBUTING for details., _(*12)

Security

If you discover any security related issues, please email ezra@tsdme.nl instead of using the issue tracker., _(*13)

Credits

• Ezra Pool
• All Contributors

License

The MIT License (MIT). Please see License File for more information., _(*14)