bicf/yii2-security-headers

Security oriented headers management

v1.2.1 2022-04-20 09:59 UTC

Requires

• yiisoft/yii2: 2.0.*

GPL-2.0-only

• Ivan Buttinoni

• yii2

README

Introduction

Yii2 implementation of CSP - Content Security Policy

See also MDN docs

Installation

Installation is recommended to be done via composer by running:

composer require bicf/yii2-security-headers "*"

Alternatively you can add the following to the require section in your composer.json manually:

{
"bicf/yii2-security-headers": "*"
}

Run composer update afterwards.

Then proceed to configuration.

Configuration

The version 1.1 is a Module implementation.

Module securityHeader sample configuration in main.php

[
    'bootstrap'=>[
        'securityHeader',
    ],
    'modules' => [
        'securityHeader' => [
            'class' => bicf\securityheaders\Module::class,
            'modules' => [
               'XContentTypeOptions'=>[
                   'class' => 'bicf\securityheaders\modules\HeaderXContentTypeOptions',
                   'value' => 'nosniff',
               ],
               'XFrameOptions'=>[
                   'class' => 'bicf\securityheaders\modules\HeaderXFrameOptions',
                   'value' => 'SAMEORIGIN',
               ],
               'AccessControlAllowMethods'=>[
                   'class' => 'bicf\securityheaders\modules\HeaderAccessControlAllowMethods',
                   'value' => 'GET',
               ],
               'AccessControlAllowOrigin'=>[
                   'class' => 'bicf\securityheaders\modules\HeaderAccessControlAllowOrigin',
                   'value' => 'https://api.example.com',
               ],
               'ContentSecurityPolicyAcl'=>[
                   'class' => 'bicf\securityheaders\modules\HeaderContentSecurityPolicyAcl',
                   'enabled' => false,
                   'policies' => [
                       'default-src' => "'self'",
                       'frame-src'   => "'self' www.facebook.com www.youtube.com www.google.com",
                       'img-src'     => "'self' www.google-analytics.com",
                       'font-src'    => "'self' fonts.gstatic.com maxcdn.bootstrapcdn.com",
                       'media-src'   => "'self'",
                       'script-src'  => "'self' www.google-analytics.com",
                       'style-src'   => "'self' maxcdn.bootstrapcdn.com",
                        'connect-src' => "'self'",
                        'report-uri'  => "/report-csp-acl",
                    ],
                ],
                'ContentSecurityPolicyMonitor'=>[
                    'class' => 'bicf\securityheaders\modules\HeaderContentSecurityPolicyMonitor',
                    'policies' => [
                        'default-src' => "'self'",
                        'frame-src'   => "'self' www.facebook.com www.youtube.com www.google.com",
                        'img-src'     => "'self' www.google-analytics.com",
                        'font-src'    => "'self' fonts.gstatic.com maxcdn.bootstrapcdn.com",
                        'media-src'   => "'self'",
                        'script-src'  => "'self' www.google-analytics.com",
                        'style-src'   => "'self' maxcdn.bootstrapcdn.com",
                        'connect-src' => "'self'",
                        'report-uri'  => "/report-csp-acl",
                    ],
                ],
            ],
        ],
    ],

    'components' => [
        // components stuff
        // no need to add anything
    ],
]

Yii2 integration of Content Security Policy Header

Possible integrations

CSP can work by signature or by the nonce token see:

Integration by signature

Done simply adding the signatures to CSP configuration

Example:

'style-src'   => "'sha256-aqNNdDLnnrDOnTNdkJpYlAxKVJtLt9CtFLklmInuUAE=' 'sha256-6fwFCXmgb6H4XQGajtDSVG3YuKmX3dT1NkX4+z510Og=' 'sha256-ZdHxw9eWtnxUb3mk6tBS+gIiVUPE3pGM470keHPDFlE='",

This kind of integration does not require patch to the framework code but it's space wasting and hard to mantain even with a small number of signatures.

Integration by nonce token

This kind of integration require some (small) patch at framework (\yii\helpers\BaseHtml) level to take full advantage of nonce token. The nonce feature (enabled by default) don't need maintenace once integrated and has reduced footprint on the header

Here follow the patched versions of BaseHtml functions to support the nonce parameter in a transparent way.

Patch to Html::script helper

The patched \yii\helpers\BaseHtml::script() :

    public static function script($content, $options = [])
    {
        if(Yii::$app->response instanceof SecureRequestInterface){
            $behavior = Yii::$app->response->getBehavior(SecureRequestInterface::CSP_NONCE_BEHAVIOR);
            if($behavior != null){
                $options = array_merge(Yii::$app->response->getContentSecurityPolicyTokenArray(),$options );
            }
        }
        return static::tag('script', $content, $options);
    }

Tag script required by the project Assets

The patched \yii\helpers\BaseHtml::jsFile() :

    public static function jsFile($url, $options = [])
    {
        $options['src'] = Url::to($url);
        if (isset($options['condition'])) {
            $condition = $options['condition'];
            unset($options['condition']);
            return self::wrapIntoCondition(static::tag('script', '', $options), $condition);
        }

        if(Yii::$app->response instanceof SecureRequestInterface){
            $behavior = Yii::$app->response->getBehavior('cspBehavior');
            if($behavior != null){
                $options = array_merge(Yii::$app->response->getContentSecurityPolicyTokenArray(),$options );
            }
        }

        return static::tag('script', '', $options);
    }

or (better?) call script funtion inside jsFile function:

    public static function jsFile($url, $options = [])
    {
        $options['src'] = Url::to($url);
        if (isset($options['condition'])) {
            $condition = $options['condition'];
            unset($options['condition']);
            return self::wrapIntoCondition(static::tag('script', '', $options), $condition);
        }

        return static::script('', $options);
    }

A different approach for <script> the views

Tag script inside the views

When the <script> is explicit used in view or controllers the solution is to add the nonce parameter directly in the tag by:

Yii::$app->response->getContentSecurityPolicyTokenAttribute()

Inside a view

<script <?= Yii::$app->response->getContentSecurityPolicyTokenAttribute();?> >
    alert("test");
</script>

A patched \yii\debug\Module::renderToolbar function

    /**
     * Renders mini-toolbar at the end of page body.
     *
     * @param \yii\base\Event $event
     */
    public function renderToolbar($event)
    {
        if (!$this->checkAccess() || Yii::$app->getRequest()->getIsAjax()) {
            return;
        }

        /* @var $view View */
        $view = $event->sender;
        echo $view->renderDynamic('return Yii::$app->getModule("' . $this->id . '")->getToolbarHtml();');

        // echo is used in order to support cases where asset manager is not available
        echo '<style>' . $view->renderPhpFile(__DIR__ . '/assets/toolbar.css') . '</style>';
        echo '<script '.Yii::$app->response->getContentSecurityPolicyTokenAttribute().'>' . $view->renderPhpFile(__DIR__ . '/assets/toolbar.js') . '</script>';
    }

In detail the line:

echo '<script '.Yii::$app->response->getContentSecurityPolicyTokenAttribute().'>' . $view->renderPhpFile(__DIR__ . '/assets/toolbar.js') . '</script>';

Runtime disabilitation

Since no header is sent until the render call it's possible to disable one or more modules as needed.  

public function actionIndex() {
    Yii::$app->getResponse()->modules['sample-module']->enabled=false;
    return $this->render("index");
}

Legacy Implementation

This is the old implementation, extending the Request Class.

IMPORTANT: If you don't setup your configuration no header will be sent.

An example of configuration:

[
    'components' => [
        'response' => [
            'class' => 'bicf\securityheaders\components\Response',
            'on afterPrepare' => ['bicf\securityheaders\components\Response','addSecurityHeaders'],
            'modules' => [
               'XContentTypeOptions'=>[
                   'class' => 'bicf\securityheaders\modules\HeaderXContentTypeOptions',
                   'value' => 'nosniff',
               ],
               'AccessControlAllowMethods'=>[
                   'class' => 'bicf\securityheaders\modules\HeaderAccessControlAllowMethods2',
                   'value' => 'GET',
               ],
               'AccessControlAllowOrigin'=>[
                   'class' => 'bicf\securityheaders\modules\HeaderAccessControlAllowOrigin',
                   'value' => 'https://api.example.com',
               ],
               'ContentSecurityPolicyAcl'=>[
                   'class' => 'bicf\securityheaders\modules\HeaderContentSecurityPolicyAcl',
                   'enabled' => false,
                   'policies' => [
                       'default-src' => "'self'",
                       'frame-src'   => "'self' www.facebook.com www.youtube.com www.google.com",
                       'img-src'     => "'self' www.google-analytics.com",
                       'font-src'    => "'self' fonts.gstatic.com maxcdn.bootstrapcdn.com",
                       'media-src'   => "'self'",
                       'script-src'  => "'self' www.google-analytics.com",
                       'style-src'   => "'self' maxcdn.bootstrapcdn.com",
                        'connect-src' => "'self'",
                        'report-uri'  => "/report-csp-acl",
                    ],
                ],
                'ContentSecurityPolicyMonitor'=>[
                    'class' => 'bicf\securityheaders\modules\HeaderContentSecurityPolicyMonitor',
                    'policies' => [
                        'default-src' => "'self'",
                        'frame-src'   => "'self' www.facebook.com www.youtube.com www.google.com",
                        'img-src'     => "'self' www.google-analytics.com",
                        'font-src'    => "'self' fonts.gstatic.com maxcdn.bootstrapcdn.com",
                        'media-src'   => "'self'",
                        'script-src'  => "'self' www.google-analytics.com",
                        'style-src'   => "'self' maxcdn.bootstrapcdn.com",
                        'connect-src' => "'self'",
                        'report-uri'  => "/report-csp-acl",
                    ],
                ],
            ],
        ],
    ],
]