alexsoft/cross-origin-protection

Cross Origin Protection middleware that uses Sec-Fetch-Site and Origin headers

1.0.0-rc1 2025-11-09 19:02 UTC

Requires

• php: ~8.1.0 || ~8.2.0 || ~8.3.0 || ~8.4.0
• php-http/discovery: ^1.17
• phpstan/phpstan-strict-rules: ^2.0
• psr/http-factory: ^1.1
• psr/http-factory-implementation: *
• psr/http-message: ^2.0
• psr/http-server-handler: ^1.0
• psr/http-server-middleware: ^1.0

Requires (Dev)

• ergebnis/composer-normalize: ^2.48.2
• guzzlehttp/psr7: ^2.8
• phpstan/phpstan: ^2.1.31
• phpunit/phpunit: ^10.5.58

MIT

• Oleksii Plekhanov

README

This library is a port of CrossOriginProtection component from Go.

You can read an introduction to the mentioned Go component here: alexedwards.net/blog/preventing-csrf-in-go.