Download the PHP package zaxbux/wn-securityheaders-plugin without Composer
On this page you can find all versions of the php package zaxbux/wn-securityheaders-plugin. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.
Download zaxbux/wn-securityheaders-plugin
More information about zaxbux/wn-securityheaders-plugin
Files in zaxbux/wn-securityheaders-plugin
Package wn-securityheaders-plugin
Short Description Easily configure HTTP response headers to increase site security.
License MIT
Homepage https://github.com/zaxbux/wn-securityheaders-plugin
FAQ
Example:
In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
- Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
- To use Composer is sometimes complicated. Especially for beginners.
- Composer needs much resources. Sometimes they are not available on a simple webspace.
- If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
- Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Informations about the package wn-securityheaders-plugin
Security Headers
This Winter CMS plugin allows you to manage a variety of security HTTP headers for your application.
See your score at securityheaders.com
CSP Nonce
This plugin generates a cryptographic nonce (128 bits, base64 encoded) for each HTTP response. To use the CSP nonce, enable the 'nonce' source for a CSP directive and include the CSPNonce component on the layout or page you want to apply the nonce. A page variable named csp_conce will contain the base64 encoded nonce.
In Case Things Break
Enabling the Content Security Policy header or the Strict Transport Security (HSTS) header could break your site if they're not setup properly. In each case, there is a command to disable the headers.
To disable the CSP from the console:
To disable HSTS from the console:
Headers by Controller
Different headers are applied to different routes, based on the controller used. The System and Backend controllers have limited security headers to avoid breaking functionality. For exmaple, the backend would require adding the unsafe-inline directive, effectivley making a CSP policy useless, so that header is not added.
System
The System\Classes\SystemController controller handles asset combining. These are the headers that may be sent:
- Strict-Transport-Security
- X-Frame-Options
- X-Content-Type-Options
- X-XSS-Protection
Backend
The Backend\Classes\BackendController controller handles the backend CMS. These are the headers that may be sent:
- Strict-Transport-Security
- X-Frame-Options
- X-Content-Type-Options
- X-XSS-Protection
CMS
The Cms\Classes\CmsController controller handles the frontend. These are the headers that may be sent:
- Strict-Transport-Security
- Referrer-Policy
- Content-Security-Policy
- X-Frame-Options
- X-Content-Type-Options
- X-XSS-Protection
- Feature-Policy
Obselete Headers
These headers are available for configuration in case legacy browsers need to be supported, but they are not recomended if you only support current browser verions.
X-Frame-Options
The X-Frame-Options header has been obsoleted by the frame-ancestors directive from CSP Level 2 for supporting browsers.
X-XSS-Protection
This header is non-standard and support has been removed (or will never be present) in a majority of browsers. You can achieve better protection using a Content Security Policy. Currently supported in IE 11 and Safari (caniuse.com).
