Download the PHP package spaze/csp-config without Composer
On this page you can find all versions of the php package spaze/csp-config. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.
Download spaze/csp-config
More information about spaze/csp-config
Files in spaze/csp-config
Package csp-config
Short Description Build Content Security Policy from a config file
License MIT
Informations about the package csp-config
csp-config
Build Content Security Policy from a config file. Supports different policy per page or module, and snippets you can add dynamically, if needed.
The library is designed to be usable with any framework (or without one) but comes with a bridge for Nette Framework.
Please note that this library will only build the header value and you still need to send the header yourself!
Installation
The best way to install the library is using Composer:
Nette Framework configuration
If you're using Nette Framework you can add the extension to your config file:
Example configuration
This is an example configuration, it's here to explain things and it's intentionally incomplete. You can also check the configuration used for my site.
Let's explain:
-
snippets
This is where you define your snippets. A snippet consists of one or more Content Security Policy directives that can be added to the current Content Security Policy header with theaddSnippet(string $snippetName)
method like this:$this->contentSecurityPolicy->addSnippet($type);
You can use it to add use it to extend your policy when there's a video on the page for example. There are sample snippets in snippets.neon which you can directly include in your configuration if you want. -
policies
Your CSP policies go here. The keys below mean[module.]presenter.action
, wildcards are supported.*.*
means use these for all presenters and actions. As you can see in the example above, I've used quite restrictive policy and will allow more later on.www.*.*
applies to all presenters and actions in the "www" module.@extends: www.*.*
this configuration extends thewww.*.*
configuration, any values specified will be added, or merged. Use it to extend the default policy for some pages or actions. You can disable merging by prefixing the directive name with!
, effectively overwriting the extended values, see below.
policiesReportOnly
Likepolicies
but intended to be used withContent-Security-Policy-Report-Only
header, see below.
Policies can contain a few special keys and values:
- keys with no values, like
upgrade-insecure-requests:
in the example above, will make the policy header contain just the key name and no values 'nonce'
will add a CSP nonce ('nonce-somethingrandomandunique
') to the header. Nonces were defined in CSP2 and are used in a recommended policy using CSP3'strict-dynamic'
. For this to work spaze/nonce-generator is needed. It will also return the immutable nonce so you can add it to your<script>
tags. This can be nicely automated with spaze/sri-macros.
Overriding values
If you don't want the extended values to be merged with the original values, prefix the directive name in the configuration with an exclamation mark (!
).
Consider the following simple example configuration:
Calling getHeader('www:...')
would then return default-src 'none' 'self'
which makes no sense and 'none'
would even be ignored.
Change the configuration to this (note the !
prefix in default-src
):
Then calling getHeader('www:...')
would return default-src 'self'
which is probably what you'd want in this case.
How to send the generated header in Nette Framework
You can get $presenter
from \Nette\Application\Application
like this for example:
And get $this->application
from dependency injection container:
If you're in a presenter then you can use $this->getAction(true)
instead.
Report-only policy
Use policiesReportOnly
configuration key to define policies to use with Content-Security-Policy-Report-Only
header:
Get the policy by calling getHeaderReportOnly()
method:
You can send both enforce and report-only policies which is useful for policy upgrades for example:
All versions of csp-config with dependencies
nette/di Version ^3.1
nette/schema Version ^1.2
spaze/nonce-generator Version ^4.0