Download the PHP package paragonie/csp-builder without Composer

Content Security Policy Builder

Easily integrate Content-Security-Policy headers into your web application, either from a JSON configuration file, or programatically.

CSP Builder was created by Paragon Initiative Enterprises as part of our effort to encourage better application security practices.

Check out our other open source projects too.

There's also a CSP middleware available that uses this library.

Installing

First, get Composer, then run:

Build a Content Security Policy header from a JSON configuration file

You can also load the configuration from a JSON string, like so:

Finally, you can just pass an array to the first argument of the constructor:

Example

Build a Content Security Policy, programmatically

Note that many of these methods can be chained together:

• addSource()
• addDirective()
• disableOldBrowserSupport()
• enableOldBrowserSupport()
• hash()
• preHash()
• setDirective()
• setBlobAllowed()
• setDataAllowed()
• setFileSystemAllowed()
• setMediaStreamAllowed()
• setReportUri()
• setSelfAllowed()
• setAllowUnsafeEval()
• setAllowUnsafeInline()

Inject a CSP header into a PSR-7 message

Instead of invoking sendCSPHeader(), you can instead inject the headers into your PSR-7 message object by calling it like so:

Save a CSP header for configuring Apache/nginx

Instead of calling sendCSPHeader() on every request, you can build the CSP once and save it to a snippet for including in your server configuration:

Make sure you reload your webserver afterwards.

Processing output before save to disk through hook

The output will change before save to file

Support Contracts

If your company uses this library in their products or services, you may be interested in purchasing a support contract from Paragon Initiative Enterprises.