393

Product support

Visit this product's website for support.

Categories

Content Security Policy Plugin

This plugin allows you to manage the Content Security Policy of your website via October's backend.

You should know what a CSP is and how it works to use this plugin. You can read more about this topic on MDN.

Features

The OFFLINE.CSP plugin provides the following features:

  • The Content-Security-Policy can be configured in the backend
  • Preview your CSP before saving it
  • Policy violations are automatically logged and can be viewed in the backend
  • A per-request nonce is generated and can be used on demand
  • The nonce can optionally be injected into all script, link and style tags automatically
  • Your CSP is patched automatically so it does not break the backend functionality (unsafe-eval and unsafe-inline are required)

Getting started

Install the plugin and visit the CSP page in the backend settings. Configure the CSP according to your needs.

By default, a strict policy is set. We suggest you make your page work with this preset for optimal security.

We suggest that you start in Report only mode. This will generate console messages and a log entry for each validation of the CSP.

You can visit the log via the backend settings. You will find a log entry for every violation generated by your site. Tune your CSP until no more violations are logged.

Now you are ready to disable the Report only mode and actually block violating requests.

Adding the CSP as a meta tag

If you don't want to add the CSP header to every response, you can opt-in for certain pages by adding this meta tag:

<meta http-equiv="content-security-policy" content="{{ csp_meta() }}">

Make sure to disable the global response header in the backend settings first. Also note, that the reporting of violations is not supported using the meta tag method (they are logged to your browser console but not to the database).

Test your CSP

You can test the strength of your CSP using Google's CSP validator or the Mozilla Observatory.

Using the nonce on demand

You can access the nonce for the current request using the csp_nonce() helper function:

<script nonce="{{ csp_nonce() }}"></script>
<style nonce="{{ csp_nonce() }}"></style>

You can enable or disable the automatic injection of the nonce via the backend settings.

When things break

A misconfigured CSP can break your site. Make sure to work in Report only mode until you have fine-tuned your site to your CSP.

If for any reason you are unable to access your site after you enabled the CSP, you can run the following console command to disable the CSP header injection completely:

php artisan csp:disable
  • Found the plugin useful on 1 Jun, 2020

    I've been waiting for a plugin that makes it easy to manage CSP headers. I guess the wait is finally over! The integrated logging of CSP violations is awesome!

1.0.12

Added workaround for Turbo PJAX requests with nonces

Aug 26, 2022

1.0.11

Fixed issue where trying to save the backend settings on new installations would result in an exception

Dec 03, 2021

1.0.10

Handle missing csp-nonce Container binding gracefully

Sep 21, 2021

1.0.9

Optimized Support for October v2

Jul 30, 2021

1.0.8

Optimized logging of csp-reports

Jul 19, 2021

1.0.7

Fixed worker sources policy for the backend (thanks to @RickAcb)

Jul 19, 2021

1.0.6

Fixed handling of empty settings (thanks to @RickAcb)

Jul 19, 2021

1.0.5

Added "offline.csp.extend" event that allows you to change the CSP on a per-page basis. An example is in the README.

Jan 06, 2021

1.0.4

Removed `require-trusted-types` policy for backend requests

Jun 05, 2020

1.0.3

Added option to add more HTTP security headers

Jun 01, 2020

1.0.2

Further optimized the handling of nonce injection

Jun 01, 2020

1.0.1

Fixed a bug where the nonce was injected into redirect responses (thanks to @marcogrueter)

Jun 01, 2020

1.0.0

Initial release

May 17, 2020