PHPackages nelmio/security-bundle - PHPackages - PHPackages [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register) 1. [Directory](/) 2. / 3. [Security](/categories/security) 4. / 5. nelmio/security-bundle ActiveSymfony-bundle[Security](/categories/security) nelmio/security-bundle ====================== Extra security-related features for Symfony: signed/encrypted cookies, HTTPS/SSL/HSTS handling, cookie session storage, ... v3.9.0(2mo ago)68112.8M↓10.3%92[14 issues](https://github.com/nelmio/NelmioSecurityBundle/issues)[3 PRs](https://github.com/nelmio/NelmioSecurityBundle/pulls)20MITPHPPHP ^7.4 || ^8.0CI passing Since Jan 8Pushed 2mo ago22 watchersCompare [ Source](https://github.com/nelmio/NelmioSecurityBundle)[ Packagist](https://packagist.org/packages/nelmio/security-bundle)[ RSS](/packages/nelmio-security-bundle/feed)WikiDiscussions master Synced 1mo ago READMEChangelog (10)Dependencies (20)Versions (56)Used By (20) NelmioSecurityBundle ==================== [](#nelmiosecuritybundle) About ----- [](#about) The NelmioSecurityBundle provides additional security features for your Symfony application. Installation ------------ [](#installation) Require the `nelmio/security-bundle` package in your composer.json and update your dependencies: ``` composer require nelmio/security-bundle ``` The bundle should be automatically enabled by [Symfony Flex](https://symfony.com/doc/current/setup/flex.html). If you don't use Flex, you'll need to enable it manually as explained [in the docs](https://symfony.com/bundles/NelmioSecurityBundle/). Features -------- [](#features) Read [the docs](https://symfony.com/bundles/NelmioSecurityBundle/) for the details and configuration needed for each feature: - **Content Security Policy**: Cross site scripting attacks (XSS) can be mitigated in modern browsers using a policy which instructs the browser never to execute inline scripts, or never to load content from another domain than the page's domain. - **Signed Cookies**: Specify certain cookies to be signed, so that the user cannot modify them. Note that they will not be encrypted, but signed only. The contents will still be visible to the user. - **Clickjacking Protection**: X-Frame-Options header is added to all responses to prevent your site from being put in a frame/iframe. This can have serious security implications as it has been demonstrated time and time again with Facebook and others. You can allow framing of your site from itself or from anywhere on a per-URL basis. - **External Redirects Detection**: Redirecting from your site to arbitrary URLs based on user input can be exploited to confuse users into clicking links that seemingly point to valid sites while they in fact lead to malicious content. It also may be possible to gain PageRank that way. - **Forced HTTPS/SSL Handling**: This forces all requests to go through SSL. It will also send [HSTS](http://tools.ietf.org/html/draft-hodges-strict-transport-sec-02) headers so that modern browsers supporting it can make users use HTTPS even if they enter URLs without https, avoiding attacks on public Wi-Fi. - **Flexible HTTPS/SSL Handling**: If you don't want to force all users to use HTTPS, you should at least use secure session cookies and force SSL for logged-in users. But then logged-in users appear logged-out when they access a non-HTTPS resource. This is not really a good solution. This will make the application detect logged-in users and redirect them to a secure URL, without making the session cookie insecure. - **Disable Content Type Sniffing**: Require that scripts are loaded using the correct mime type. This disables the feature that some browsers have which uses content sniffing to determine if the response is a valid script file or not. - (DEPRECATED) **XSS Protection**: Enables/Disables Microsoft XSS Protection on compatible browsers (IE 8 and newer). - **Referrer Policy**: `Referrer-Policy` header is added to all responses to control the `Referer` header that is added to requests made from your site, and for navigations away from your site by browsers. Testing ------- [](#testing) The bundle provides PHPUnit assertions to test security headers in your application. See [TESTING.md](TESTING.md) for details. Usage ----- [](#usage) See [the documentation](https://symfony.com/bundles/NelmioSecurityBundle/) for usage instructions. License ------- [](#license) Released under the MIT License, see LICENSE. ### Health Score 73 — ExcellentBetter than 100% of packages Maintenance83 Actively maintained with recent releases Popularity69 Solid adoption and visibility Community43 Growing community involvement Maturity82 Battle-tested with a long release history Bus Factor2 2 contributors hold 50%+ of commits How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window. **Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores. **Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement. **Maturity (30%)** — Project age, version count, PHP version support, and release stability. ### Release Activity Cadence Every ~90 days Total 54 Last Release 85d ago Major Versions 1.10.0 → 2.0.02016-05-17 v2.12.0 → v3.0.0-alpha.12022-02-23 PHP version history (2 changes)v2.8.0PHP >5.4 v3.0.0-alpha.1PHP ^7.4 || ^8.0 ### Community Maintainers ![](https://www.gravatar.com/avatar/b69782e1d7f426ef78f61d159c466a536372eff931f13981ac578fa3f4649352?d=identicon)[Seldaek](/maintainers/Seldaek) --- Top Contributors [![Seldaek](https://avatars.githubusercontent.com/u/183678?v=4)](https://github.com/Seldaek "Seldaek (190 commits)")[![romainneutron](https://avatars.githubusercontent.com/u/137574?v=4)](https://github.com/romainneutron "romainneutron (177 commits)")[![franmomu](https://avatars.githubusercontent.com/u/720690?v=4)](https://github.com/franmomu "franmomu (106 commits)")[![damienalexandre](https://avatars.githubusercontent.com/u/225704?v=4)](https://github.com/damienalexandre "damienalexandre (25 commits)")[![igorw](https://avatars.githubusercontent.com/u/88061?v=4)](https://github.com/igorw "igorw (19 commits)")[![rickard2](https://avatars.githubusercontent.com/u/488425?v=4)](https://github.com/rickard2 "rickard2 (13 commits)")[![martijnc](https://avatars.githubusercontent.com/u/965129?v=4)](https://github.com/martijnc "martijnc (10 commits)")[![lstrojny](https://avatars.githubusercontent.com/u/79707?v=4)](https://github.com/lstrojny "lstrojny (7 commits)")[![ruudk](https://avatars.githubusercontent.com/u/104180?v=4)](https://github.com/ruudk "ruudk (6 commits)")[![Spomky](https://avatars.githubusercontent.com/u/1091072?v=4)](https://github.com/Spomky "Spomky (5 commits)")[![silasjoisten](https://avatars.githubusercontent.com/u/10114981?v=4)](https://github.com/silasjoisten "silasjoisten (5 commits)")[![stof](https://avatars.githubusercontent.com/u/439401?v=4)](https://github.com/stof "stof (4 commits)")[![pscheit](https://avatars.githubusercontent.com/u/488189?v=4)](https://github.com/pscheit "pscheit (4 commits)")[![schmittjoh](https://avatars.githubusercontent.com/u/197017?v=4)](https://github.com/schmittjoh "schmittjoh (4 commits)")[![DemonTPx](https://avatars.githubusercontent.com/u/2570835?v=4)](https://github.com/DemonTPx "DemonTPx (3 commits)")[![Phobetor](https://avatars.githubusercontent.com/u/712973?v=4)](https://github.com/Phobetor "Phobetor (3 commits)")[![javiereguiluz](https://avatars.githubusercontent.com/u/73419?v=4)](https://github.com/javiereguiluz "javiereguiluz (3 commits)")[![Matth--](https://avatars.githubusercontent.com/u/5814301?v=4)](https://github.com/Matth-- "Matth-- (3 commits)")[![maxhelias](https://avatars.githubusercontent.com/u/12966574?v=4)](https://github.com/maxhelias "maxhelias (3 commits)")[![ihmels](https://avatars.githubusercontent.com/u/9105856?v=4)](https://github.com/ihmels "ihmels (3 commits)") --- Tags bundlecsphstshttpsphpsecuritysymfonyxsssecurity ### Code Quality TestsPHPUnit Static AnalysisPHPStan Type Coverage Yes ### Embed Badge ![Health badge](/badges/nelmio-security-bundle/health.svg) ``` [![Health](https://phpackages.com/badges/nelmio-security-bundle/health.svg)](https://phpackages.com/packages/nelmio-security-bundle) ``` ### Alternatives [sylius/sylius E-Commerce platform for PHP, based on Symfony framework. 8.4k5.6M651](/packages/sylius-sylius)[contao/core-bundle Contao Open Source CMS 1231.6M2.4k](/packages/contao-core-bundle)[sulu/sulu Core framework that implements the functionality of the Sulu content management system 1.3k1.3M152](/packages/sulu-sulu)[prestashop/prestashop PrestaShop is an Open Source e-commerce platform, committed to providing the best shopping cart experience for both merchants and customers. 9.0k15.4k](/packages/prestashop-prestashop)[symfony/security-bundle Provides a tight integration of the Security component into the Symfony full-stack framework 2.5k172.9M1.8k](/packages/symfony-security-bundle)[shopware/platform The Shopware e-commerce core 3.3k1.5M3](/packages/shopware-platform) PHPackages © 2026 [Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)