kronos/csp

A Content-Security-Policy header builder

v2.1.0 2025-01-28 15:20 UTC

Requires

• php: ^8.3

Requires (Dev)

• cyclonedx/cyclonedx-php-composer: 5.2.1
• dealerdirect/phpcodesniffer-composer-installer: 1.0.0
• kronostechnologies/php-coding-standard: 2.0.0
• phpcompatibility/php-compatibility: 9.3.5
• phpunit/phpunit: 11.5.3
• squizlabs/php_codesniffer: 3.11.3
• vimeo/psalm: 6.0.0

MIT

• csp
• content-security-policy
• kronos

README

A PHP Content-Security-Policy header generator library.

Usage

Using the Builder:

$factory = new \Kronos\ContentSecurityPolicy\Factory();
$builder = $factory->createContentSecurityPolicyBuilder(); 

$builder->setDefaultSrc(\Kronos\ContentSecurityPolicy\Policy::FETCH_NONE);

$policy = $builder->getContentSecurityPolicy();

header($policy->getHeader());

Using the PolicyDirectorInterface:

Director class:

use Kronos\ContentSecurityPolicy\Factory;
use Kronos\ContentSecurityPolicy\Policy;
use Kronos\ContentSecurityPolicy\PolicyDirectorInterface;

class Director implements PolicyDirectorInterface
{

    /** @var Factory */
    protected $factory;
    
    ...

    /**
     * @param Factory $factory
     * ...
     */
    public function __construct(Factory $factory, ...)
    {
        $this->factory = $factory;
        ...
    }

    public function buildContentSecurityPolicy()
    {
        $builder = $this->factory->createContentSecurityPolicyBuilder();

        $builder->setDefaultSrc([Policy::FETCH_NONE]);
        $builder->setObjectSrc([Policy::FETCH_NONE]);
        $builder->setStyleSrc([
            'mysite.example/css',
            'fonts.googleapis.com',
            'fonts.gstatic.com',
            Policy::FETCH_UNSAFE_INLINE
        ]);
        $builder->setFontSrc([
            'mysite.example/fonts',
            'fonts.googleapis.com',
            Policy::FETCH_UNSAFE_INLINE
        ]);
        $builder->setFrameAncestors([Policy::FETCH_NONE]);

        $builder->setReportUri('mysite.example/api/csp-report/');
        $builder->setReportOnly();

        return $builder->getContentSecurityPolicy();
    }

}

Code:

$factory = new \Kronos\ContentSecurityPolicy\Factory();
$director = new Director($factory);

$policy = $director->buildContentSecurityPolicy();

header($policy->getHeader());