Download the PHP package martijnc/php-csp without Composer

On this page you can find all versions of the php package martijnc/php-csp. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.

FAQ

After the download, you have to make one include require_once('vendor/autoload.php');. After that you have to import the classes with use statements.

Example:
If you use only one package a project is not needed. But if you use more then one package, without a project it is not possible to import the classes with use statements.

In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
Some PHP packages are not free to download and because of that hosted in private repositories. In this case some credentials are needed to access such packages. Please use the auth.json textarea to insert credentials, if a package is coming from a private repository. You can look here for more information.

  • Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
  • To use Composer is sometimes complicated. Especially for beginners.
  • Composer needs much resources. Sometimes they are not available on a simple webspace.
  • If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
  • Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Please rate this library. Is it a good library?

Informations about the package php-csp

PHP CSP

A PHP helper class to dynamically construct Content Security Policy headers as defined by the W3C in the Content Security Policy specification (http://www.w3.org/TR/CSP2/).

How to use

Add php-csp to your project and create an instance of the ContentSecurityPolicyHeaderBuilder class and use it to setup your CSP policy. Once your policy is complete, use ContentSecurityPolicyHeaderBuilder::getHeaders() to get your CSP header.

ContentSecurityPolicy::getHeaders() returns an array of HTTP headers you should send. For the example above this results in the following array:

Source expressions

The most straightforward use of this class is by adding origins to the directives of your choice like in this example:

This example would output the following headers:

Source sets

You can define source-sets and link them to any CSP directive you want. For example

Would result in the following headers:

Nonces

CSP blocks inline scripts but they can be enabled again by adding unsafe-inline to the script-src directive. Doing this would defeat the entire purpose of using CSP and therefor, the use of unsafe-inline is not recommended. If you need to inline scripts for whatever reason, you should use nonces. A nonce is a random string you add to the script-src directive and the inline script tags you allow on your webpage like in the following example:

Would result in the following headers:

Your HTML should look like this:

The nonce should be random for each request so attackers cannot predict the nonce value.

Hashes

If your application requires inline scripts you can serve the SHA256, SHA384, or SHA512 hash of the source as part of the script-src directive in your policy to allow the script to run. This way you don't need to enable unsafe-inline.

Violation reports

CSP gives you the option to receive reports about CSP violations. Each time a page loads a resource that is blocked by your CSP policy, the browser will submit a JSON object to the URL you specified in your policy. In the following example, those report will be send to https://example.com/csp/report.php:

You can also use CSP in a report-only mode. This mode is ideal if you are implenting CSP on an existing website without breaking things. Each time a resource load violates your CSP policy, the browser will send a violation report but it won't actually block the resource.

Legacy header support

This class also provides support for some legacy headers which are being replaced by CSP. Currently it has support for the X-XSS-Protection and X-Frame-Options headers.

This would result in the following headers:


All versions of php-csp with dependencies

PHP Build Version
Package Version
Requires php Version >=5.4.0
Composer command for our command line client (download client) This client runs in each environment. You don't need a specific PHP version etc. The first 20 API calls are free. Standard composer command

The package martijnc/php-csp contains the following files

Loading the files please wait ....