Download the PHP package jdz/cspmaker without Composer
On this page you can find all versions of the php package jdz/cspmaker. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.
Package cspmaker
Short Description Build Content Security Policy (CSP) header strings from a fluent builder, a config array/file, or reusable third-party integration recipes
License MIT
Homepage https://jdz.joffreydemetz.com/cspmaker
FAQ
Example:
In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
- Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
- To use Composer is sometimes complicated. Especially for beginners.
- Composer needs much resources. Sometimes they are not available on a simple webspace.
- If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
- Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Informations about the package cspmaker
jdz/cspmaker
Build Content Security Policy header strings without forgetting a directive.
The whole point: a third party like Matomo needs to be whitelisted in script-src
and img-src and connect-src. Hand-list those and you will eventually
forget one — and the browser silently blocks the request. cspMaker gives you one
source of truth for the CSP directive vocabulary, plus reusable integration
recipes that know every directive a service touches.
Requires PHP 8.2+. Zero runtime dependencies (symfony/yaml is only needed for
CspBuilder::fromYaml()).
Three ways in, one header out
1. Fluent builder
->allowHost($host, ['script','img','connect']) is the low-level primitive when
there's no recipe: one host across many directives in a single call.
2. Config array or YAML file
fromArray() accepts the same structured shape, or a flat directive => sources map.
3. Named integration recipes
matomo($host), googleFonts(), googleAnalytics(), googleTagManager(),
youtube(), recaptcha(), stripe() — each expands to exactly the directives
that service requires. Ship your own by implementing Integration and
registering it:
Niceties
- Short aliases —
script↔script-src,img↔img-src, … - Token normalization —
self→'self',data→data:, nonces/hashes quoted. - Validation — adding a source to a misspelled directive throws instead of silently vanishing.
'none'collapse, dedup, and a stable canonical render order.default-srcseeding — a fetch directive created on the fly byadd(), an integration orallowInline()starts fromdefault-src's sources (creatingscript-srcwould otherwise stop thedefault-srcfallback and block the site's own scripts). Not withset(), not when'none'is added, not forbase-uri/form-action/frame-ancestors, and only oncedefault-srcis there.report-tonames one reporting group: the last one given.lint()— advisories: missingdefault-src; a fetch directive without'self'whiledefault-srchas it;'unsafe-inline', and'unsafe-inline'next to a nonce or hash; unconstrainedobject-src; a directive present but empty (report-toincluded).
Changelog
- 1.1.2 (2026-10-11) — a fetch directive created on the fly starts from
default-src's sources (it started empty: an integration orallowInline()blocked the site's own scripts; see Niceties);report-tokeeps one group, the last given (several were emitted);lint()warns on a fetch directive without'self'whiledefault-srchas it, on'unsafe-inline'next to a nonce or hash, and on an emptyreport-to.
Used by
jdz/htaccessmaker's CspContainer
delegates to cspMaker to emit the Content-Security-Policy header.
