|
1 | 1 | <?php
|
2 | 2 |
|
3 | 3 | // specify the default directive treatment
|
4 |
| -$response->CSP->reportOnly(false); |
| 4 | +$this->response->CSP->reportOnly(false); |
5 | 5 |
|
6 | 6 | // specify the origin to use if none provided for a directive
|
7 |
| -$response->CSP->setDefaultSrc('cdn.example.com'); |
| 7 | +$this->response->CSP->setDefaultSrc('cdn.example.com'); |
8 | 8 |
|
9 | 9 | // specify the URL that "report-only" reports get sent to
|
10 |
| -$response->CSP->setReportURI('http://example.com/csp/reports'); |
| 10 | +$this->response->CSP->setReportURI('http://example.com/csp/reports'); |
11 | 11 |
|
12 | 12 | // specify that HTTP requests be upgraded to HTTPS
|
13 |
| -$response->CSP->upgradeInsecureRequests(true); |
| 13 | +$this->response->CSP->upgradeInsecureRequests(true); |
14 | 14 |
|
15 | 15 | // add types or origins to CSP directives
|
16 | 16 | // assuming that the default treatment is to block rather than just report
|
17 |
| -$response->CSP->addBaseURI('example.com', true); // report only |
18 |
| -$response->CSP->addChildSrc('https://youtube.com'); // blocked |
19 |
| -$response->CSP->addConnectSrc('https://*.facebook.com', false); // blocked |
20 |
| -$response->CSP->addFontSrc('fonts.example.com'); |
21 |
| -$response->CSP->addFormAction('self'); |
22 |
| -$response->CSP->addFrameAncestor('none', true); // report this one |
23 |
| -$response->CSP->addImageSrc('cdn.example.com'); |
24 |
| -$response->CSP->addMediaSrc('cdn.example.com'); |
25 |
| -$response->CSP->addManifestSrc('cdn.example.com'); |
26 |
| -$response->CSP->addObjectSrc('cdn.example.com', false); // reject from here |
27 |
| -$response->CSP->addPluginType('application/pdf', false); // reject this media type |
28 |
| -$response->CSP->addScriptSrc('scripts.example.com', true); // allow but report requests from here |
29 |
| -$response->CSP->addStyleSrc('css.example.com'); |
30 |
| -$response->CSP->addSandbox(['allow-forms', 'allow-scripts']); |
| 17 | +$this->response->CSP->addBaseURI('example.com', true); // report only |
| 18 | +$this->response->CSP->addChildSrc('https://youtube.com'); // blocked |
| 19 | +$this->response->CSP->addConnectSrc('https://*.facebook.com', false); // blocked |
| 20 | +$this->response->CSP->addFontSrc('fonts.example.com'); |
| 21 | +$this->response->CSP->addFormAction('self'); |
| 22 | +$this->response->CSP->addFrameAncestor('none', true); // report this one |
| 23 | +$this->response->CSP->addImageSrc('cdn.example.com'); |
| 24 | +$this->response->CSP->addMediaSrc('cdn.example.com'); |
| 25 | +$this->response->CSP->addManifestSrc('cdn.example.com'); |
| 26 | +$this->response->CSP->addObjectSrc('cdn.example.com', false); // reject from here |
| 27 | +$this->response->CSP->addPluginType('application/pdf', false); // reject this media type |
| 28 | +$this->response->CSP->addScriptSrc('scripts.example.com', true); // allow but report requests from here |
| 29 | +$this->response->CSP->addStyleSrc('css.example.com'); |
| 30 | +$this->response->CSP->addSandbox(['allow-forms', 'allow-scripts']); |
0 commit comments