README

FyreCSP is a free, open-source content security policy library for PHP.

Table Of Contents

• Installation
• Basic Usage
• Methods
• Policies
• Middleware

Installation

Using Composer

composer require fyre/csp

In PHP:

use Fyre\Security\ContentSecurityPolicy;

Basic Usage

• $config is a Config.

$csp = new ContentSecurityPolicy($config);

Default configuration options will be resolved from the "Csp" key in the Config.

• $options is an array containing configuration options.
  • default is an array containing the policy directives, and will default to [].
  • report is an array containing the report-only directives, and will default to null.
  • reportTo is an array containing the Report-To header value, and will default to [].

$container->use(Config::class)->set('Csp', $options);

Autoloading

It is recommended to bind the ContentSecurityPolicy to the Container as a singleton.

$container->singleton(ContentSecurityPolicy::class);

Any dependencies will be injected automatically when loading from the Container.

$csp = $container->use(ContentSecurityPolicy::class);

Methods

Add Headers

Add CSP headers to a ClientResponse.

• $response is a ClientResponse.

$newResponse = $csp->addHeaders($response);

Clear

Clear all policies.

$csp->clear();

Create Policy

Create a Policy.

• $key is a string representing the policy key, and should be one of either ContentSecurityPolicy::DEFAULT or ContentSecurityPolicy::REPORT.
• $directives is an array containing the directives to add, and will default to [].

$csp->createPolicy($key, $directives);

Get Policy

Get a Policy.

• $key is a string representing the policy key, and should be one of either ContentSecurityPolicy::DEFAULT or ContentSecurityPolicy::REPORT.

$policy = $csp->getPolicy($key);

Get Policies

Get all policies.

$policies = $csp->getPolicies();

Get Report To

Get the Report-To values.

$reportTo = $csp->getReportTo();

Has Policy

Determine whether a policy exists.

• $key is a string representing the policy key, and should be one of either ContentSecurityPolicy::DEFAULT or ContentSecurityPolicy::REPORT.

$hasPolicy = $csp->hasPolicy($key);

Set Policy

Set a policy.

• $key is a string representing the policy key, and should be one of either ContentSecurityPolicy::DEFAULT or ContentSecurityPolicy::REPORT.
• $policy is a Policy.

$csp->setPolicy($key, $policy);

Set Report To

Set the Report-To values.

• $reportTo is an array containing the Report-To values.

$csp->setReportTo($reportTo);

Policies

Add Directive

Add options to a directive.

• $directive is a string representing the directive.
• $value is a string, or an array of strings containing the values to add. For directives that don't require values, you can set this to true or false indicating whether to include the directive.

$newPolicy = $policy->addDirective($directive, $value);

Get Directive

Get the options for a directive.

• $directive is a string representing the directive.

$options = $policy->getDirective($directive);

Get Header

Get the header string.

$header = $policy->getHeader();

Has Directive

Determine whether a directive exists.

• $directive is a string representing the directive.

$hasDirective = $policy->hasDirective($directive);

Remove Directive

Remove a directive.

• $directive is a string representing the directive.

$newPolicy = $policy->removeDirective($directive);

Middleware

use Fyre\Security\Middleware\CspMiddleware;

• $csp is a ContentSecurityPolicy.

$middleware = new CspMiddleware($csp);

Any dependencies will be injected automatically when loading from the Container.

$middleware = $container->build(CspMiddleware::class);

Handle

Handle a ServerRequest.

• $request is a ServerRequest.
• $next is a Closure.

$response = $middleware->handle($request, $next);

This method will return a ClientResponse.