Download the PHP package aubes/csp-bundle without Composer

Content Security Policy Bundle

Symfony bundle for managing Content-Security-Policy headers.

• Presets to get started in seconds (strict, permissive, api)
• Nonces and hashes via Twig helpers and block tags
• Multi-group policies with per-controller PHP attributes
• Audit command (csp:check) to detect misconfigurations
• Violation reporting with Reporting-Endpoints and legacy Report-To support
• Worker-ready (FrankenPHP / RoadRunner)

Requirements: PHP >= 8.2, Symfony ^6.4 | ^7.4 | ^8.0

Installation

For Twig nonce/hash support:

Configuration

Presets

Three built-in presets provide sensible defaults:

Preset policies are merged with your custom policies. Your policies extend the preset, they don't replace it.

Note: The strict preset uses strict-dynamic which requires nonces to work. Without nonces, all scripts will be blocked. Make sure you use the Twig nonce helpers in your templates:

Directive names

Use underscore-separated names in YAML configuration:

Usage

Applying CSP headers

Auto default

With auto_default: true, the default group is applied to every response automatically.

PHP attributes

Use attributes on controllers to select groups or disable CSP:

Multi-group constraint: each request supports at most one enforcing group and one report-only group. Applying two groups of the same mode (e.g. two enforcing groups) will throw a LogicException. This is by design: the HTTP spec says multiple Content-Security-Policy headers are intersected (most restrictive wins), which would silently break additive policies.

Route defaults

You can also configure groups via route defaults:

Dynamic directives

Add directives at runtime from a controller:

Twig: nonces

Nonces are generated per-request and automatically added to the CSP header.

Block tags (recommended)

Wraps your inline script/style with a nonce automatically:

Functions

For manual nonce attributes:

Twig: hashes

Register a hash for inline content without using a nonce:

Reporting

Configuration

Enable Reporting-Endpoints (modern) and optionally Report-To (legacy):

Note: Multiple endpoints can be configured, but only the first one is used with the modern Reporting-Endpoints header (which supports a single URL per group). Additional endpoints are only used when backward_compatibility: true is enabled, as the legacy Report-To header supports failover across multiple URLs.

Built-in report controller

A controller is included to receive CSP violation reports (path: /csp-report/{group}, route: csp_report). Each report is dispatched as a CSPViolationEvent.

Import the bundle's routing:

Or define the route manually:

Handling violation reports

Listen to CSPViolationEvent to handle reports however you want (log, Sentry, database, Slack, etc.):

Built-in logger

Optionally enable the built-in log listener to log violations via Monolog:

Without report_logger, events are dispatched but not logged.

Audit command

Audit your CSP configuration against common security pitfalls:

The command checks for: missing critical directives, unsafe-inline/unsafe-eval usage, wildcard sources, HTTP/IP sources, strict-dynamic without nonce, trusted types consistency, and missing reporting.

Web Debug Toolbar

When symfony/web-profiler-bundle is installed, a CSP panel is available in the Symfony profiler showing:

• Active group(s) and enabled/disabled status
• Full CSP header value
• Parsed directives with color-coded sources (keywords, nonces, hashes, URLs)
• Report-Only header if present
• Reporting endpoints

Debug mode

Set debug: true to force all groups into report-only mode. Useful during development to detect violations without breaking the page:

Gradual rollout

Hardening your CSP without breaking your site is easy with multi-group policies. The idea: enforce a permissive policy today, evaluate a strict one in parallel, then switch when ready.

Step 1: enforce permissive, evaluate strict

Apply both groups to your controllers:

The permissive group enforces (nothing breaks), while strict runs in report-only mode. Violations are sent to your reporting endpoint.

Step 2: fix violations

Review reports and add nonces to your inline scripts and styles:

Step 3: switch to strict

Once reports are clean, promote strict to enforcing and remove the permissive group:

Worker mode (FrankenPHP / RoadRunner)

The CSP service implements ResetInterface. Nonces and dynamic directives are automatically reset between requests in long-running processes.