marko / security

0.11.0 2026-10-06 15:09 UTC

Requires

• php: ^8.5
• marko/config: 0.11.0
• marko/core: 0.11.0
• marko/encryption: 0.11.0
• marko/routing: 0.11.0
• marko/session: 0.11.0

Requires (Dev)

• marko/authentication: 0.11.0
• marko/cors: 0.11.0
• marko/testing: 0.11.0

Suggests

• marko/authentication: Rotates the CSRF token on login and logout

MIT

Published on Packagist.org on 2026-10-06 15:41 UTC

README

CSRF protection and security headers middleware -- secure your routes with drop-in middleware. For CORS, use marko/cors.

Installation

composer require marko/security

Quick Example

CsrfMiddleware and SecurityHeadersMiddleware are registered globally, so every state-changing route is protected and every response carries security headers. Opt a route out explicitly:

use Marko\Routing\Attributes\Post;
use Marko\Routing\Attributes\WithoutMiddleware;
use Marko\Security\Middleware\CsrfMiddleware;

class WebhookController
{
    #[Post('/webhooks/stripe')]
    #[WithoutMiddleware(CsrfMiddleware::class)]
    public function receive(): Response
    {
        return new Response('Received');
    }
}

Documentation

Full usage, API reference, and examples: marko/security