secure-headers Add security related headers to HTTP response. The package includes extension for easy Yii2 integration.

  1. Installation
  2. Configuration (usage)
  3. Parameter description
  4. PHPUnit Tests

Add security related headers to HTTP response. The package includes extension for easy Yii2 integration.

Installation 

composer require hyperia/yii2-secure-headers:"^1.0"

Configuration (usage) 

'bootstrap'  => [..., 'headers'],
'components' => [
    ...
    'headers' => [
        'class' => '\hyperia\security\Headers',
        'upgradeInsecureRequests' => true,
        'blockAllMixedContent' => true,
        'stsMaxAge' => 10,
        'xFrameOptions' => 'DENY',
        'xPoweredBy' => 'Hyperia',
        'publicKeyPins' => '',
        'reportUri' => 'https://company.report-uri.io',
        'cspDirectives' => [
            'script-src' => "'self' 'unsafe-inline'",
            'style-src' => "'self' 'unsafe-inline'",
            'img-src' => "'self' data:",
            'connect-src' => "'self'",
            'font-src' => "'self'",
            'object-src' => "'self'",
            'media-src' => "'self'",
            'form-action' => "'self'",
            'frame-src' => "'self'",
            'child-src' => "'self'"
        ]
    ]
]

Parameter description

Source Value Example Description
| img-src Wildcard, allows any URL except data: blob: filesystem: schemes.
'none' object-src 'none' Prevents loading resources from any source.
'self' script-src 'self' Allows loading resources from the same origin (same scheme, host and port).
data: img-src 'self' data: Allows loading resources via the data scheme (eg Base64 encoded images).
domain.example.com img-src domain.example.com Allows loading resources from the specified domain name.
.example.com | img-src .example.com Allows loading resources from any subdomain under example.com.
https://cdn.com img-src https://cdn.com Allows loading resources only over HTTPS matching the given domain.
https: img-src https: Allows loading resources only over HTTPS on any domain.
'unsafe-inline' script-src 'unsafe-inline' Allows use of inline source elements such as style attribute, onclick, or script tag bodies (depends on the context of the source it is applied to)
'unsafe-eval' script-src 'unsafe-eval' Allows unsafe dynamic code evaluation such as JavaScript eval()
Policy

Each header has a reference link in config file, you should read it if you do not know the header. If you want to disable a string type header, just set to null or empty string.

Public Key Pinning

When hashes is empty array, this header will not add to http response.

Content Security Policy

We use paragonie/csp-builder to help us support csp header. If you want to disable csp header, set custom-csp to empty string.

Additional Resources

Everything you need to know about HTTP security headers

PHPUnit Tests

change phpunit.xml.dist to phpunit.xml and run

./vendor/bin/phpunit -c phpunit.xml
1 0
1 follower
0 downloads
Yii Version: 2.0
License: MIT
Category: Security
Tags: extension, header, http, https, secure, Security, yii2
Developed by: hyperia.sk
Created on: Jun 28, 2017
Last updated: 7 years ago

Related Extensions