PHPackages                             flowpack/content-security-policy - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [Security](/categories/security)
4. /
5. flowpack/content-security-policy

ActiveNeos-package[Security](/categories/security)

flowpack/content-security-policy
================================

Configure your content-security-policy header easily with yaml.

1.2.0(4mo ago)53.6k↓37.7%1[2 issues](https://github.com/Flowpack/Flowpack.ContentSecurityPolicy/issues)MITPHPPHP ^8.1CI passing

Since Oct 21Pushed 2mo ago9 watchersCompare

[ Source](https://github.com/Flowpack/Flowpack.ContentSecurityPolicy)[ Packagist](https://packagist.org/packages/flowpack/content-security-policy)[ RSS](/packages/flowpack-content-security-policy/feed)WikiDiscussions main Synced 1mo ago

READMEChangelog (5)Dependencies (6)Versions (8)Used By (0)

Flowpack.ContentSecurityPolicy
==============================

[](#flowpackcontentsecuritypolicy)

- [Flowpack.ContentSecurityPolicy](#flowpackcontentsecuritypolicy)
    - [Introduction](#introduction)
    - [Usage](#usage)
    - [Custom directives and values](#custom-directives-and-values)
        - [Show CSP configuration](#show-csp-configuration)
    - [Disable or report only](#disable-or-report-only)
    - [Nonce](#nonce)
    - [Backend](#backend)
    - [Thank you](#thank-you)

Introduction
------------

[](#introduction)

Flow/Neos package to set your site's content security policy header easily with yaml.

Usage
-----

[](#usage)

Import the package using composer:

```
composer require flowpack/content-security-policy
```

The package is automatically active once imported. By default, the response header `Content-Security-Policy` will now be included.

It will use the default configuration which looks like this:

```
Flowpack:
  ContentSecurityPolicy:
    enabled: true
    report-only: false
    content-security-policy:
      default:
        base-uri:
          'self': true
        connect-src:
          'self': true
        default-src:
          'self': true
        form-action:
          'self': true
        img-src:
          'self': true
        media-src:
          'self': true
        frame-src:
          'self': true
        object-src:
          'self': true
        script-src:
          'self': true
        style-src:
          'self': true
        style-src-attr:
          'self': true
        style-src-elem:
          'self': true
        font-src:
          'self': true
      custom: [ ]
```

Now only resources from the same origin are allowed for the most common directives. It is enabled by default and the report-only mode is disabled.

Deprecated Configuration
------------------------

[](#deprecated-configuration)

Make sure to change any old configuration to the new object format. **Support for the old list format will be removed in future versions.**

The new config allows to merge configurations from different packages/yaml files.

```
frame-src:
    # Deprecated list format
    # - 'https://www.youtube.com':
    # - 'https://staticxx.facebook.com':

    # New object format
    'https://www.youtube.com': true
    'https://staticxx.facebook.com': true
```

Custom directives and values
----------------------------

[](#custom-directives-and-values)

If you want to override the default config don't forget to add this package as a dependency in the composer.json file of your package. Otherwise, it might not work because of the loading order of the packages.

The default configuration will probably not suit your needs so you can add your own configuration by adding the array custom like this in your own yaml configuration files:

```
Flowpack:
  ContentSecurityPolicy:
    content-security-policy:
      custom:
        frame-src:
          'https://www.youtube.com': true
          'https://staticxx.facebook.com': true
```

If you fully want to override the entire default config then just override the default key in yaml.

### Show CSP configuration

[](#show-csp-configuration)

To show the parsed configuration, the built-in command `./flow cspconfig:show` can be used. It shows all directives used by the frontend and the backend.

Disable or report only
----------------------

[](#disable-or-report-only)

To disable the header simply set `enabled` to false. If you want to add it as a report only header set `report-only` to true. That way you have the option to see the possible errors without breaking functionality.

Nonce
-----

[](#nonce)

You might want to use a nonce to allow inline scripts and styles to be still secure. To do this simply add `{nonce}` as an option in a directive. Like this:

```
Flowpack:
  ContentSecurityPolicy:
    content-security-policy:
      custom:
        script-src:
          '{nonce}': true
```

Now the header will include a `nonce-automatedgeneratedrandomstring` in the script-src directive. So inline scripts without the corresponding nonce will be blocked.

The nonce will be automatically added to all your script/style tags.

Backend
-------

[](#backend)

Due to the current nature of the Neos backend being rendered a bit different then the frontend a separate policy is added for the backend. I currently have found no suitable way the add the nonce in the inline scripts in the Neos UI package. So the CSP for the backend looks like this:

```
Flowpack:
  ContentSecurityPolicy:
    content-security-policy:
      backend:
        base-uri:
          'self': true
        connect-src:
          'self': true
        default-src:
          'self': true
        form-action:
          'self': true
        img-src:
          'self': true
          'data:': true
        media-src:
          'self': true
        frame-src:
          'self': true
        object-src:
          'self': true
        script-src:
          'self': true
          'unsafe-inline': true
          'unsafe-eval': true
        style-src:
          'self': true
          'unsafe-inline': true
        style-src-attr:
          'self': true
          'unsafe-inline': true
        style-src-elem:
          'self': true
          'unsafe-inline': true
        font-src:
          'self': true
          'data:': true
      custom-backend: [ ]
```

Unsafe inline scripts and styles are allowed in the backend because otherwise the backend won't work.

Again you can add your own policies in the custom-backend array the same way as the custom array for the frontend.

Thank you
---------

[](#thank-you)

This package originates from .

Thank you Lars Nieuwenhuizen for your work.

###  Health Score

45

—

FairBetter than 93% of packages

Maintenance75

Regular maintenance activity

Popularity29

Limited adoption so far

Community11

Small or concentrated contributor base

Maturity53

Maturing project, gaining track record

 Bus Factor1

Top contributor holds 100% of commits — single point of failure

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Every ~113 days

Total

5

Last Release

120d ago

### Community

Maintainers

![](https://www.gravatar.com/avatar/25d49a6af82b72d2764774a05c307808375016d7aeaaef3862472a6580ff38a7?d=identicon)[flowpack](/maintainers/flowpack)

---

Top Contributors

[![t-heuser](https://avatars.githubusercontent.com/u/53174153?v=4)](https://github.com/t-heuser "t-heuser (20 commits)")

---

Tags

content-security-policycspflowneosneoscms

###  Code Quality

TestsPHPUnit

Static AnalysisPHPStan

Type Coverage Yes

### Embed Badge

![Health badge](/badges/flowpack-content-security-policy/health.svg)

```
[![Health](https://phpackages.com/badges/flowpack-content-security-policy/health.svg)](https://phpackages.com/packages/flowpack-content-security-policy)
```

###  Alternatives

[defuse/php-encryption

Secure PHP Encryption Library

3.9k162.4M214](/packages/defuse-php-encryption)[mews/purifier

Laravel 5/6/7/8/9/10 HtmlPurifier Package

2.0k16.7M113](/packages/mews-purifier)[robrichards/xmlseclibs

A PHP library for XML Security

41478.1M118](/packages/robrichards-xmlseclibs)[bjeavons/zxcvbn-php

Realistic password strength estimation PHP library based on Zxcvbn JS

87117.5M63](/packages/bjeavons-zxcvbn-php)[illuminate/encryption

The Illuminate Encryption package.

9229.7M280](/packages/illuminate-encryption)[paragonie/hidden-string

Encapsulate strings in an object to hide them from stack traces

7410.6M39](/packages/paragonie-hidden-string)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)