Content Security Policy

A really easy way to build CSP headers and add them to the response.

Install

Via Composer

$ composer require zae/content-security-policy

Laravel

Service Provider

Add the service provider to the app.php file.

Middleware

Add the middleware to the middleware Kernel.

Config

return [
	BlockAllMixedContent::class,
    Sandbox::class => [
        Sandbox::ALLOW_FORMS,
        Sandbox::ALLOW_SCRIPTS,
        Sandbox::ALLOW_TOP_NAVIGATION,
        Sandbox::ALLOW_SAME_ORIGIN,
        Sandbox::ALLOW_POPUPS,
    ]
];

Other

Although not officially supported yet, it's possible to use this library with other frameworks, an easy method is by using FluidDirectivesFactory.

Fluid Factory

<?php
$csp = new CSP();
$factory = new FluidDirectivesFactory($csp);
$factory
    ->blockAllMixedContent()
    ->defaultSrc([
        Directive::SELF,
        'https:'
    ])
    ->baseUri([
        Directive::SELF
    ]);

Change log

Please see CHANGELOG for more information on what has changed recently.

Contributing

Please see CONTRIBUTING for details.

Security

If you discover any security related issues, please email ezra@tsdme.nl instead of using the issue tracker.

Credits

• Ezra Pool
• All Contributors

License

The MIT License (MIT). Please see License File for more information.