nowo-tech / http-hardening-bundle

v1.5.0 2026-10-14 07:28 UTC

Requires

• php: >=8.2 <8.6
• symfony/config: ^7.4 || ^8.0
• symfony/dependency-injection: ^7.4 || ^8.0
• symfony/http-foundation: ^7.4 || ^8.0
• symfony/http-kernel: ^7.4 || ^8.0
• symfony/security-core: ^7.4 || ^8.0

Requires (Dev)

• friendsofphp/php-cs-fixer: ^3.64
• igor-php/igor-php: ^0.10.0
• nowo-tech/phpstan-frankenphp: ^1.0
• phpstan/extension-installer: ^1.4
• phpstan/phpstan: ^2.0
• phpstan/phpstan-phpunit: ^2.0
• phpstan/phpstan-symfony: ^2.0
• phpunit/phpunit: ^11.0
• rector/rector: ^2.0
• symfony/console: ^7.4 || ^8.0
• symfony/phpunit-bridge: ^7.4 || ^8.0
• symfony/yaml: ^7.4 || ^8.0
• twig/twig: ^3.12

Suggests

• symfony/console: For the nowo:http-hardening:lint-csp-nonces command
• symfony/flex: For automatic recipe installation
• symfony/security-bundle: Lets anonymous_session_strip / public_cache recognise signed-in users (without it every visitor is anonymous)
• twig/twig: For the csp_nonce() / |csp_stamp and safe_internal_path() / safe_href() Twig helpers

MIT

• Héctor Franco Aceituno
• Nowo.tech

• symfony
• cache
• session
• cdn
• csp
• symfony-bundle
• hardening
• content-security-policy
• hsts
• security-headers

Published on Packagist.org on 2026-10-14 07:28 UTC

README

⭐ Found this useful? Install it from Packagist and star HttpHardeningBundle.

Symfony bundle for public HTTP hardening:

• Security headers — X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy, Cross-Origin-Resource-Policy, optional HSTS
• Anonymous session strip — remove the session cookie on configured public GET/HEAD routes so CDNs and checkers see cacheable HTML
• Content-Security-Policy (opt-in) — per-request nonce in the csp_nonce request attribute, policy built from config, nonce stamping of inline <script>/<style> (skipped on data-csp-strict-nonce layouts), CspSourceProviderInterface for runtime origins, csp_nonce() / |csp_stamp Twig helpers
• CSP nonce lint — nowo:http-hardening:lint-csp-nonces [dirs...] fails on inline Twig blocks without a nonce (CI-friendly)
• Public cache (opt-in) — private, max-age=120, must-revalidate + Vary: Cookie on anonymous public pages, public policy on crawler/PWA files, no ETag on nonce'd HTML; coexists with the session strip
• No-store paths (opt-in) — Cache-Control: no-store, private and no ETag / Last-Modified on paths (PCRE) or routes holding credentials; wins over every other cache policy
• Canonical host (opt-in) — single 301 from www. to the apex host of your public base URL
• Safe URLs — SafeInternalRedirect service (open-redirect guard) and SafeHref, with optional safe_internal_path() / safe_href() Twig functions
• Bounded request body — BoundedRequestBody::read($request, $maxBytes) streams the raw body with a hard cap (chunked bodies without Content-Length included) and throws a 413 RequestBodyTooLargeException
• Worker-safe Web Profiler CSP — in dev, WebProfilerBundle's CSP handler is made non-shared so a /_wdt or /_profiler request cannot strip the CSP header from later pages in FrankenPHP worker mode (web_profiler.isolate_csp_handler, on by default, no-op in prod)

Compatible with Symfony 7.4, 8.0, and 8.1. PHP 8.2+ (Symfony 8.x requires PHP 8.4+).

Requirements

• PHP ≥ 8.2
• Symfony 7.4 or 8.x (http-kernel, security-core)
• Optional: twig/twig (Twig helpers), symfony/console (lint command)

Quick start

composer require nowo-tech/http-hardening-bundle

Security headers are on by default. Everything else (session strip, CSP, public cache, no-store paths, canonical host, safe-URL Twig functions) is opt-in — see Configuration and Usage.

Documentation

• Installation
• Configuration
• Usage
• Contributing
• Code of Conduct
• Changelog
• Upgrading
• Release
• Security
• Engram
• Spec-driven development
• GitHub Spec Kit

Additional documentation

• PSR evaluation

Tests and coverage

make test
make test-coverage

PHP statement coverage: 100% (Clover gate ≥99% in CI).

License

MIT — Nowo.tech