PHPackages                             wieni/wmcontent\_security\_policy - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [Security](/categories/security)
4. /
5. wieni/wmcontent\_security\_policy

ActiveDrupal-module[Security](/categories/security)

wieni/wmcontent\_security\_policy
=================================

Secure your Drupal site using a Content Security Policy header

1.2.0(1y ago)03.0k↓83.8%1[2 issues](https://github.com/wieni/wmcontent_security_policy/issues)MITPHPPHP ^7.2 || ^8.0

Since Apr 12Pushed 1y ago3 watchersCompare

[ Source](https://github.com/wieni/wmcontent_security_policy)[ Packagist](https://packagist.org/packages/wieni/wmcontent_security_policy)[ RSS](/packages/wieni-wmcontent-security-policy/feed)WikiDiscussions main Synced yesterday

READMEChangelog (3)Dependencies (4)Versions (7)Used By (0)

Content Security Policy
=======================

[](#content-security-policy)

[![Latest Stable Version](https://camo.githubusercontent.com/d8e626b3d27ea0376cda0f2add15a7fc34e19dfb7160382e75cb31fd5c7b46d5/68747470733a2f2f706f7365722e707567782e6f72672f7769656e692f776d636f6e74656e745f73656375726974795f706f6c6963792f762f737461626c65)](https://packagist.org/packages/wieni/wmcontent_security_policy)[![Total Downloads](https://camo.githubusercontent.com/61734e4c5e83055f5802ee37b6fb07da18ac145657e53abaefb07449c4caaaa4/68747470733a2f2f706f7365722e707567782e6f72672f7769656e692f776d636f6e74656e745f73656375726974795f706f6c6963792f646f776e6c6f616473)](https://packagist.org/packages/wieni/wmcontent_security_policy)[![License](https://camo.githubusercontent.com/f960e040b815c0f49210f8969116b3c2e8deffee4b81ac990e71df6dedc5467d/68747470733a2f2f706f7365722e707567782e6f72672f7769656e692f776d636f6e74656e745f73656375726974795f706f6c6963792f6c6963656e7365)](https://packagist.org/packages/wieni/wmcontent_security_policy)

> Secure your site using a Content Security Policy header

Why?
----

[](#why)

- Content Security Policy adds a security layer to **detect and mitigate the risk of Cross Site Scripting (XSS), data injection, and other vulnerabilities**.
- The [`csp` Drupal module](https://www.drupal.org/project/csp) is more feature-complete, but ours has a **simpler interface** and **doesn't allow inline scripts on pages using Drupal AJAX**.

Installation
------------

[](#installation)

This package requires PHP 7.2 and Drupal 8 or higher. It can be installed using Composer:

```
 composer require wieni/wmcontent_security_policy drupal/multivalue_form_element:dev-3199142-drupal-9-compatibility"
```

### Patches

[](#patches)

For this module to work, it is necessary to patch Drupal core and the [Multi-value form element module](https://www.drupal.org/project/multivalue_form_element). If you manage your installation with Composer, you should use the [cweagans/composer-patches](https://github.com/cweagans/composer-patches)package to manage and automatically apply patches. If not, please check the [documentation](https://www.drupal.org/patch/apply) for instructions on how to manually apply patches.

If the patches below don't apply to your package versions, you should visit the relevant issues and find older or newer patches.

```
// composer.json
{
    "extra": {
        "composer-exit-on-patch-failure": true,
        "patches": {
            "drupal/core": {
              "#2264739: Allow multiple field widgets to not use tabledrag": "https://www.drupal.org/files/issues/2021-01-23/2264739-105.patch"
            },
            "drupal/multivalue_form_element": {
              "#3199172 Handle default values of nested elements": "https://git.drupalcode.org/project/multivalue_form_element/-/merge_requests/2.patch",
              "#3199298 Don't add an empty element when the multivalue element is disabled": "https://git.drupalcode.org/project/multivalue_form_element/-/merge_requests/3.patch",
              "#3200306 Add support for non-orderable multivalue form elements": "https://git.drupalcode.org/project/multivalue_form_element/-/commit/ef4d01ae56a809fc2349d8fec8185ace3b63d15d.patch"
            }
        }
    }
}
```

How does it work?
-----------------

[](#how-does-it-work)

### Managing default sources

[](#managing-default-sources)

Using the form at `/admin/config/system/content-security-policy/default-sources`, you can set default sources for the different policy directives. These sources should be required for the website to function properly.

Sources you add there are stored in configuration, so you can export them and add them to version control.

To manage these sources, you need the `administer default content security policy sources` permission.

### Managing custom sources

[](#managing-custom-sources)

Using the form at `/admin/config/system/content-security-policy/custom-sources`, you can add custom sources to the different policy directives.

Sources you add here are stored in the database and will not be exported with configuration. This is useful to allow content editors to add sources required for certain site content.

To manage these sources, you need the `administer custom content security policy sources` permission.

### Adding script hashes

[](#adding-script-hashes)

If you want to include certain inline scripts (eg. a Google Analytics snippet) without allowing `script-src: 'unsafe-inline'`, you can add the hashes of these scripts to your `script-src` policy (more information [here](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/script-src#unsafe_inline_script)).

You can add script hashes in Twig by using the `addCspHash` function:

```
{{ addCspHash("'sha256-n4MwUTyKKCBlMIFkvcS3dkmlRFEcqSm/V0IOhZelzA0='") }}
```

You can add script hashes in code by using `wmcontent_security_policy.content_security_policy:addScriptHash`:

```
\Drupal::service('wmcontent_security_policy.content_security_policy')
    ->addScriptHash("'sha256-n4MwUTyKKCBlMIFkvcS3dkmlRFEcqSm/V0IOhZelzA0='");
```

Finally, it's also possible to add script hashes like any other source through the administration forms.

### Events

[](#events)

One event is provided, which allows you to dynamically add sources right before the header is built.

```