Download the PHP package nelmio/security-bundle without Composer
On this page you can find all versions of the php package nelmio/security-bundle. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.
FAQ
Example:
In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
- Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
- To use Composer is sometimes complicated. Especially for beginners.
- Composer needs much resources. Sometimes they are not available on a simple webspace.
- If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
- Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Informations about the package security-bundle
NelmioSecurityBundle
About
The NelmioSecurityBundle provides additional security features for your Symfony application.
Installation
Require the nelmio/security-bundle package in your composer.json and update your dependencies:
The bundle should be automatically enabled by Symfony Flex. If you don't use Flex, you'll need to enable it manually as explained in the docs.
Features
Read the docs for the details and configuration needed for each feature:
-
Content Security Policy: Cross site scripting attacks (XSS) can be mitigated in modern browsers using a policy which instructs the browser never to execute inline scripts, or never to load content from another domain than the page's domain.
-
Signed Cookies: Specify certain cookies to be signed, so that the user cannot modify them. Note that they will not be encrypted, but signed only. The contents will still be visible to the user.
-
Clickjacking Protection: X-Frame-Options header is added to all responses to prevent your site from being put in a frame/iframe. This can have serious security implications as it has been demonstrated time and time again with Facebook and others. You can allow framing of your site from itself or from anywhere on a per-URL basis.
-
External Redirects Detection: Redirecting from your site to arbitrary URLs based on user input can be exploited to confuse users into clicking links that seemingly point to valid sites while they in fact lead to malicious content. It also may be possible to gain PageRank that way.
-
Forced HTTPS/SSL Handling: This forces all requests to go through SSL. It will also send HSTS headers so that modern browsers supporting it can make users use HTTPS even if they enter URLs without https, avoiding attacks on public Wi-Fi.
-
Flexible HTTPS/SSL Handling: If you don't want to force all users to use HTTPS, you should at least use secure session cookies and force SSL for logged-in users. But then logged-in users appear logged-out when they access a non-HTTPS resource. This is not really a good solution. This will make the application detect logged-in users and redirect them to a secure URL, without making the session cookie insecure.
-
Disable Content Type Sniffing: Require that scripts are loaded using the correct mime type. This disables the feature that some browsers have which uses content sniffing to determine if the response is a valid script file or not.
-
(DEPRECATED) XSS Protection: Enables/Disables Microsoft XSS Protection on compatible browsers (IE 8 and newer).
- Referrer Policy:
Referrer-Policyheader is added to all responses to control theRefererheader that is added to requests made from your site, and for navigations away from your site by browsers.
Usage
See the documentation for usage instructions.
License
Released under the MIT License, see LICENSE.
All versions of security-bundle with dependencies
symfony/deprecation-contracts Version ^2.5 || ^3
symfony/framework-bundle Version ^5.4 || ^6.3 || ^7.0
symfony/http-kernel Version ^5.4 || ^6.3 || ^7.0
symfony/security-core Version ^5.4 || ^6.3 || ^7.0
symfony/security-csrf Version ^5.4 || ^6.3 || ^7.0
symfony/security-http Version ^5.4 || ^6.3 || ^7.0
symfony/yaml Version ^5.4 || ^6.3 || ^7.0
ua-parser/uap-php Version ^3.4.4