Download the PHP package unocha/ocha_security without Composer
On this page you can find all versions of the php package unocha/ocha_security. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.
FAQ
Example:
In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
- Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
- To use Composer is sometimes complicated. Especially for beginners.
- Composer needs much resources. Sometimes they are not available on a simple webspace.
- If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
- Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Informations about the package ocha_security
Ocha Security
This is primarily a helper for the seckit module. More security-related fixes that apply to all sites would be welcome.
CSP rules are a bit confusing. Add to or improve these notes if they make it more so.
Seckit module helper.
Prepares hashes, or a nonce for logged-in users, to allow CSP protection for scripts. Requires the seckit module, with this patch. (Note, the patch might soon be replaced, check status on the ticket).
This is necessary to avoid rules allowing the use of 'eval' or 'unsafe-inline', for 'script-src' which undermine the point of using the seckit module.
Note that it is recommended to use 'unsafe-inline' if a nonce or a hash is included, as this will work with CSP level 1 browsers but will be ignored by CSP level 2 browsers. Not the best reference
For logged-in users, where the page is not cached, a nonce (Number used ONCE) must be generated for each request, but can be used for all of the scripts.
For anonymous users, where the page is cached, a hash must be created for each separate script. Inline scripts use a hash of the script itself, attached files use a hash of the filename. These can be re-used across requests.
This adds hashes or a nonce to script elements, assets and attachments, and the same to the CSP directives.
Notes
@todo Find a resource to explain what Drupal means by 'element', 'asset' and 'attachment'.
Adds nonce to/ creates hash for scripts as:
Elements (via pre-render hook)
src/Element/OchaSecurityHtmlPreRender.php
Assets
src/Asset/OchaSecurityAssetResolver.php
Attachments
ocha_security_page_attachments_alter()
Also ensures the sameSite=Lax header for cookies, though this is now default
behavior in modern browsers
src/Session/OchaSecuritySessionConfiguration.php
Hashes and nonces require extra work - they "are only intended for cases where removing inline scripts is not an option" (source). We might consider using only hashes and caching them.
'strict-dynamic' overrides any allowed domains in the seckit configuration, but only for browsers which implement CSP-v3. So a nonce or hash is necessary for all scripts.
