assayer-pro/yii2-cspreport

Yii2 Module for Content Security Policy Report

1.0.1 2016-02-20 15:43 UTC

Requires

• yiisoft/yii2: >=2.0.6

MIT

• Assayer Pro

README

yii2 Module for Content Security Policy Report

Installation

The preferred way to install this extension is through composer.

• Either run

php composer.phar require --prefer-dist "assayer-pro/yii2-cspreport" "*"

or add

"assayer-pro/yii2-cspreport" : "*"

to the require section of your application's composer.json file.

Usage

• Add a new module in modules section of your application's configuration file, for example:

    'modules' => [
        'csp-report' => [
            'class' => 'assayerpro\cspreport\Module',
            'message' => [
                'from' => '[e-mail]',
                'to' => '[e-mail]',
                'subject' => 'Content Security Policy Report',
            ],
        ],
    ],

• Add a new rule for urlManager of your application's configuration file, for example:

    'components' => [
    ...
        'urlManager' => [
            'rules' => [
                'csp-report' => 'csp-report/report/index',
            ],
        ],
    ...
    ],

• Add application/csp-report parser:

    'components' => [
    ...
        'request' => [
            'parsers' => [
                'application/csp-report' => 'yii\web\JsonParser',
            ],
        ],
    ...
    ],

• Apache Content-Security-Policy Header

Add the following to your httpd.conf in your VirtualHost or in an .htaccess file:

Header set Content-Security-Policy-Report-Only "default-src https:; script-src https: 'unsafe-eval' 'unsafe-inline'; style-src https: 'unsafe-inline'; img-src https: data:; font-src https: data:; report-uri /csp-report;"

• Nginx Content-Security-Policy Header

In your server {} block add:

   add_header Content-Security-Policy-Report-Only "default-src https:; script-src https: 'unsafe-eval' 'unsafe-inline'; style-src https: 'unsafe-inline'; img-src https: data:; font-src https: data:; report-uri /csp-report";

You can also append always to the end to ensure that nginx sends the header reguardless of response code.