PHP code example of acolyte / laravel-security

    
        
<?php
require_once('vendor/autoload.php');

/* Start to develop here. Best regards https://php-download.com/ */

    

acolyte / laravel-security example snippets

use Acolyte\LaravelSecurity\Middleware\SecurityHeaders;
use Illuminate\Foundation\Configuration\Middleware;

->withMiddleware(function (Middleware $middleware): void {
    $middleware->append(SecurityHeaders::class);
})

return [
    'enabled' => true,
    'hsts' => [
        'enabled' => true,
        'max_age' => 31536000,
        '    'nonce' => [
            'enabled' => false,
            'directives' => ['script-src', 'style-src'],
            'request_attribute' => 'csp_nonce',
        ],
        'directives' => [
            'default-src' => ["'self'"],
            'script-src' => ["'self'"],
            'style-src' => ["'self'"],
            'img-src' => ["'self'", 'data:', 'https:'],
            'object-src' => ["'none'"],
            'base-uri' => ["'self'"],
            'frame-ancestors' => ["'none'"],
        ],
    ],
    'content_type_options' => 'nosniff',
    'referrer_policy' => 'strict-origin-when-cross-origin',
    'frame_options' => 'SAMEORIGIN',
    'permissions_policy' => [
        'enabled' => true,
        'policies' => [
            'camera' => [],
            'microphone' => [],
            'geolocation' => [],
        ],
    ],
    'remove_x_powered_by' => true,
    'custom_headers' => [],
];

'hsts' => [
    'enabled' => true,
    'max_age' => 31536000,
    '

'nonce' => [
    'enabled' => true,
    'directives' => ['script-src', 'style-src'],
    'request_attribute' => 'csp_nonce',
],

'permissions_policy' => [
    'enabled' => true,
    'policies' => [
        'camera' => [],
        'fullscreen' => ['self', 'https://video.example'],
        'publickey-credentials-get' => ['*'],
    ],
],

'csp' => [
    'enabled' => true,
    'report_only' => false,
    'directives' => ['default-src' => ["'none'"], 'frame-ancestors' => ["'none'"]],
],

'directives' => [
    'default-src' => ["'self'"],
    'script-src' => ["'self'", 'https://cdn.example'],
    'style-src' => ["'self'", 'https://fonts.googleapis.com'],
    'font-src' => ["'self'", 'https://fonts.gstatic.com'],
    'img-src' => ["'self'", 'data:', 'https:'],
    'object-src' => ["'none'"],
    'base-uri' => ["'self'"],
    'frame-ancestors' => ["'none'"],
],

'csp' => [
    'enabled' => true,
    'report_only' => true,
    'directives' => [
        'default-src' => ["'self'"],
        'report-uri' => ['https://reports.example/csp'],
    ],
],

'csp' => [
    'enabled' => (bool) env('SECURITY_CSP_ENABLED', true),
    'report_only' => (bool) env('SECURITY_CSP_REPORT_ONLY', false),
    // ...
],

use Acolyte\LaravelSecurity\Middleware\SecurityHeaders;

Route::middleware(SecurityHeaders::class)->group(function (): void {
    Route::get('/', HomeController::class);
});

'custom_headers' => [
    'Cross-Origin-Resource-Policy' => 'same-site',
],

bash
php artisan vendor:publish --tag=laravel-security-config