Download the PHP package martijnc/php-csp without Composer
On this page you can find all versions of the php package martijnc/php-csp. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.
Download martijnc/php-csp
More information about martijnc/php-csp
Files in martijnc/php-csp
Package php-csp
Short Description Content Security Policy helper for PHP
License BSD
Homepage https://github.com/martijnc/php-csp
FAQ
Example:
In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
- Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
- To use Composer is sometimes complicated. Especially for beginners.
- Composer needs much resources. Sometimes they are not available on a simple webspace.
- If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
- Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Informations about the package php-csp
PHP CSP
A PHP helper class to dynamically construct Content Security Policy headers as defined by the W3C in the Content Security Policy specification (http://www.w3.org/TR/CSP2/).
How to use
Add php-csp to your project and create an instance of the ContentSecurityPolicyHeaderBuilder class and use it to setup your CSP policy. Once your policy is complete, use ContentSecurityPolicyHeaderBuilder::getHeaders() to get your CSP header.
ContentSecurityPolicy::getHeaders() returns an array of HTTP headers you should send. For the example above this results in the following array:
Source expressions
The most straightforward use of this class is by adding origins to the directives of your choice like in this example:
This example would output the following headers:
Source sets
You can define source-sets and link them to any CSP directive you want. For example
Would result in the following headers:
Nonces
CSP blocks inline scripts but they can be enabled again by adding unsafe-inline to the script-src directive. Doing this would defeat the entire purpose of using CSP and therefor, the use of unsafe-inline is not recommended. If you need to inline scripts for whatever reason, you should use nonces. A nonce is a random string you add to the script-src directive and the inline script tags you allow on your webpage like in the following example:
Would result in the following headers:
Your HTML should look like this:
The nonce should be random for each request so attackers cannot predict the nonce value.
Hashes
If your application requires inline scripts you can serve the SHA256, SHA384, or SHA512 hash of the source as part of the script-src directive in your policy to allow the script to run. This way you don't need to enable unsafe-inline.
Violation reports
CSP gives you the option to receive reports about CSP violations. Each time a page loads a resource that is blocked by your CSP policy, the browser will submit a JSON object to the URL you specified in your policy. In the following example, those report will be send to https://example.com/csp/report.php:
You can also use CSP in a report-only mode. This mode is ideal if you are implenting CSP on an existing website without breaking things. Each time a resource load violates your CSP policy, the browser will send a violation report but it won't actually block the resource.
Legacy header support
This class also provides support for some legacy headers which are being replaced by CSP. Currently it has support for the X-XSS-Protection and X-Frame-Options headers.
This would result in the following headers:
