Download the PHP package offline/oc-csp-plugin without Composer

On this page you can find all versions of the php package offline/oc-csp-plugin. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.

FAQ

After the download, you have to make one include require_once('vendor/autoload.php');. After that you have to import the classes with use statements.

Example:
If you use only one package a project is not needed. But if you use more then one package, without a project it is not possible to import the classes with use statements.

In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
Some PHP packages are not free to download and because of that hosted in private repositories. In this case some credentials are needed to access such packages. Please use the auth.json textarea to insert credentials, if a package is coming from a private repository. You can look here for more information.

  • Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
  • To use Composer is sometimes complicated. Especially for beginners.
  • Composer needs much resources. Sometimes they are not available on a simple webspace.
  • If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
  • Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Please rate this library. Is it a good library?

Example code of offline/oc-csp-plugin

Informations about the package oc-csp-plugin

oc-csp-plugin

This plugin allows you to manage the Content Security Policy of your website via October's backend.

You should know what a CSP is and how it works to use this plugin. You can read more about this topic on MDN.

Features

The OFFLINE.CSP plugin provides the following features:

Getting started

Install the plugin and visit the CSP page in the backend settings. Configure the CSP according to your needs.

By default, a strict policy is set. We suggest you make your page work with this preset for optimal security.

We suggest that you start in Report only mode. This will generate console messages and a log entry for each validation of the CSP.

You can visit the log via the backend settings. You will find a log entry for every violation generated by your site. Tune your CSP until no more violations are logged.

Now you are ready to disable the Report only mode and actually block violating requests.

Adding the CSP as a meta tag

If you don't want to add the CSP header to every response, you can opt-in for certain pages by adding this meta tag:

Make sure to disable the global response header in the backend settings first. Also note, that the reporting of violations is not supported using the meta tag method (they are logged to your browser console but not to the database).

Test your CSP

You can test the strength of your CSP using Google's CSP validator or the Mozilla Observatory.

Using the nonce on demand

You can access the nonce for the current request using the csp_nonce() helper function:

You can enable or disable the automatic injection of the nonce via the backend settings.

Modifying the CSP dynamically

Sometimes, you need to change your CSP configuration for a single page only. You can listen for the offline.csp.extend event and modify the CSP settings to your needs.

When things break

A misconfigured CSP can break your site. Make sure to work in Report only mode until you have fine-tuned your site to your CSP.

If for any reason you are unable to access your site after you enabled the CSP, you can run the following console command to disable the CSP header injection completely:

Integration with October's Turbo Router

If you are using October's Turbo Router together with a nonce, your assets will be included on every Turbo requests since Turbo thinks it is a new asset because of the new nonce attribute.

A possible solution to this problem is to send a X-Turbo-Nonce header with every request. If this header is present, the CSP plugin will re-cycle the nonce and return new content with the old nonce.

Please note that this does reduce the security of the nonce feature since a nonce becomes long-lived over multiple requests.

Example implementation

Add a csp-nonce meta tag to your head section:

Listen for the ajax:request-start event and add the X-Turbo-Nonce header to every request:

All versions of oc-csp-plugin with dependencies

PHP Build Version
Package Version
Requires php Version >=7.1
offline/laravel-csp Version dev-master
Composer command for our command line client (download client) This client runs in each environment. You don't need a specific PHP version etc. The first 20 API calls are free. Standard composer command

The package offline/oc-csp-plugin contains the following files

Loading the files please wait ....