Laravel Security Laravel Package

Product Decisions This Supports

• Compliance & Security Roadmap: Accelerates implementation of OWASP Top 10 (A03:2021 Injection, A07:2021 Identification & Authentication Failures) and PCI DSS requirements (e.g., CSP, HSTS) without custom engineering. Aligns with ISO 27001 controls for secure headers.
• Build vs. Buy: Buy for teams lacking security expertise or time to manually configure CSP/SRI. Reduces technical debt by providing pre-validated defaults (e.g., Google’s Strict CSP pattern) and third-party integrations (GTM, Stripe, reCAPTCHA).
• Use Cases:
  • High-assurance apps (finance, healthcare) needing automated CSP enforcement with violation tracking.
  • Marketing sites using CMS/headless CMS (Filament, Livewire) where inline scripts/styles are unavoidable.
  • Vapor/Lambda deployments requiring SRI manifest caching in the Lambda bundle.
  • Legacy apps migrating to modern security headers without breaking existing integrations.

When to Consider This Package

• Adopt if:

  • Your Laravel app uses Vite, Filament, Livewire, or Vapor (native support).
  • You need CSP with nonces but lack time to implement Google’s Strict CSP manually.
  • You require SRI for critical assets (e.g., frontend bundles) with third-party noise filtering.
  • Your compliance team demands HSTS, CSP, or Permissions-Policy with minimal dev effort.
  • You’re blocked by CSP violations from tools like GTM, HubSpot, or reCAPTCHA (pre-configured directives).

• Look elsewhere if:

  • You’re on Laravel <11 or PHP <8.2 (unsupported).
  • Your stack doesn’t use Blade/Vite (e.g., pure API with SPAs; SRI/nonces are less critical).
  • You need fine-grained CSP per route (this uses global middleware; consider spatie/laravel-csp for granularity).
  • Your asset pipeline is dynamic (e.g., no build step for SRI manifests; requires manual sri:warm workarounds).
  • You’re already using a dedicated WAF (e.g., Cloudflare, AWS WAF) that handles headers centrally.

How to Pitch It (Stakeholders)

For Executives:

*"This package automates 80% of our web security compliance—HSTS, CSP, SRI—with zero dev time. It’s like a ‘firewall for your frontend’:

• Blocks XSS/CSRF via Strict CSP (Google’s battle-tested pattern).
• Prevents supply-chain attacks by pinning critical assets (SRI).
• Integrates seamlessly with GTM, Stripe, and reCAPTCHA—no more CSP errors.
• Cost: Free (MIT license), ROI: Reduces breach risk and dev toil. Risk: Minimal; runs in ‘report-only’ mode during testing."*

For Engineering:

*"This is a drop-in security middleware that:

• Replaces manual CSP headers with auto-generated nonces and strict-dynamic (modern browsers).
• Handles SRI manifest generation and runtime asset pinning (works with Vapor/Livewire).
• Catches CSP/SRI violations and logs them to DB/logs (defense-in-depth).
• Zero config needed: Run php artisan security:install for an interactive wizard that auto-configures GTM, HubSpot, etc.
• Performance impact: Negligible (headers are static; SRI middleware only runs on HTML responses). Tradeoff: Global CSP (not per-route), but 90% of apps don’t need granularity."*

For Security/Compliance:

*"This eliminates manual CSP/SRI configuration—a top attack vector. Key benefits:

• Strict CSP by default: Blocks inline scripts unless explicitly nonced (mitigates XSS).
• SRI with noise filtering: Only reports your assets’ failures, not third-party CDNs.
• HSTS + Permissions-Policy: Covers transport security and feature allowlists (e.g., blocks camera/microphone unless explicitly allowed).
• Violation tracking: Logs CSP/SRI failures to DB/logs for incident response. Validation: Uses Google’s Strict CSP and OWASP-recommended headers out of the box."*