Download the PHP package bicf/yii2-security-headers without Composer
On this page you can find all versions of the php package bicf/yii2-security-headers. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.
FAQ
Example:
In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
- Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
- To use Composer is sometimes complicated. Especially for beginners.
- Composer needs much resources. Sometimes they are not available on a simple webspace.
- If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
- Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Informations about the package yii2-security-headers
Yii2 headers security
Introduction
Yii2 implementation of CSP - Content Security Policy
See also MDN docs
Installation
Installation is recommended to be done via composer by running:
composer require bicf/yii2-security-headers "*"Alternatively you can add the following to the require section in your composer.json manually:
Run composer update afterwards.
Then proceed to configuration.
Configuration
The version 1.1 is a Module implementation.
Module securityHeader sample configuration in main.php
Yii2 integration of Content Security Policy Header
Possible integrations
CSP can work by signature or by the nonce token see:
Integration by signature
Done simply adding the signatures to CSP configuration
Example:
This kind of integration does not require patch to the framework code but it's space wasting and hard to mantain even with a small number of signatures.
Integration by nonce token
This kind of integration require some (small) patch at framework (\yii\helpers\BaseHtml) level to take full advantage of nonce token. The nonce feature (enabled by default) don't need maintenace once integrated and has reduced footprint on the header
Here follow the patched versions of BaseHtml functions to support the nonce parameter in a transparent way.
Patch to Html::script helper
The patched \yii\helpers\BaseHtml::script() :
Tag script required by the project Assets
The patched \yii\helpers\BaseHtml::jsFile() :
or (better?) call script funtion inside jsFile function:
A different approach for <script> the views
Tag script inside the views
When the <script> is explicit used in view or controllers the solution is to add the nonce parameter directly in the tag by:
Yii::$app->response->getContentSecurityPolicyTokenAttribute()
Inside a view
A patched \yii\debug\Module::renderToolbar function
In detail the line:
Runtime disabilitation
Since no header is sent until the call it's possible to disable one or more modules as needed.
Legacy Implementation
This is the old implementation, extending the Request Class.
IMPORTANT: If you don't setup your configuration no header will be sent.
An example of configuration:
