Weave Code
Nbcsb Bundle Laravel Package
netbrothers-gmbh/nbcsb-bundle
NetBrothers Content Security Bundle (NBCSB) adds Content Security Policy support to Symfony apps. Configure CSP directives, nonces, and reporting from bundle configuration to restrict allowed content sources and improve protection against XSS and injection attacks.
Creating skeleton structure for symfony bundle with one single command. Creates directory structure and necessary files, activates your bundle. See: https://netbrothers.de/easy-create-reusable-symfony-bundle
Frequently asked questions about Nbcsb Bundle
- What does netbrothers-gmbh/nbcsb-bundle do?
- It is the NetBrothers Content Security Bundle, a Symfony bundle that adds Content Security Policy support to Symfony applications. You configure CSP directives, nonces, and reporting through bundle configuration to restrict allowed content sources and improve protection against XSS and injection attacks. It is intended to give teams a consistent CSP baseline while keeping rules overridable per project.
- How do I install netbrothers-gmbh/nbcsb-bundle with Composer?
- Install it with composer require netbrothers-gmbh/nbcsb-bundle. Symfony Flex can register the bundle with zero-config setup; without Flex, register it manually in your Symfony bundle configuration. Before installing v3, confirm that your application meets the Symfony 7, PHP 8.2+, and Laravel 11+ compatibility baseline.
- Which Laravel versions are supported by NBCSB v3?
- Version 3.0.0 declares a hard Symfony constraint of >=7 <8 in composer.json, which generally maps to Laravel 11+ and PHP 8.2+ in the Laravel ecosystem. It does not fit Laravel 10 or Symfony 6.4 applications without a framework upgrade, and Composer resolution will likely block those installs. Treat the official support matrix as something to verify before scheduling the upgrade.
- How do I configure CSP directives in a Symfony app?
- Define your policy through the bundle configuration, including directives such as default-src, script-src, style-src, and related source lists. Start with a report-only policy so you can see what would be blocked before enforcing it. Keep environment-specific overrides in config so staging and production can differ without forking the package.
- How do nonces work with the Content Security Policy bundle?
- The bundle supports nonces so you can allow specific inline scripts or styles instead of loosening script-src or style-src with unsafe-inline. Generate a fresh nonce per request, add it to the relevant tags, and make sure the same value appears in the CSP header. Do not cache pages with a reused nonce, because that weakens the protection.
- Does netbrothers-gmbh/nbcsb-bundle support CSP reporting?
- Yes, the bundle supports reporting from bundle configuration, so you can collect violation reports while you tune the policy. Configure your report endpoint and monitor violations in staging or a canary environment before switching to enforcement. Reporting is most useful when paired with a report-only rollout and a review of blocked resources.
- Is v3.0.0 a breaking change from v2?
- Treat v3.0.0 as a platform-compatibility gate rather than a routine feature release. The major-version signal and hard Symfony >=7 <8 floor make it breaking for legacy consumers, even though the release notes do not describe code-level BC breaks. Confirm API changes, deprecations, and migration steps, and keep a lockfile-based rollback to v2.x.
- Can I override the default CSP rules per project?
- Yes, the bundle is designed to provide sensible defaults while leaving every rule and script overridable per project. Use configuration overrides for environment-specific directives, reporting endpoints, and nonce behavior rather than editing vendor code. That keeps your baseline consistent while still allowing exceptions where an application needs them.
- How should I test CSP changes before deploying to production?
- Roll out in report-only mode first, then review violations in staging or a canary deployment before enforcing the policy. Run your full test suite and check that nonces, reporting endpoints, and any public integration points behave as expected. Also run Composer dependency checks so mixed package versions do not break CI.
- What are the alternatives to using a CSP bundle in Laravel?
- Alternatives include setting Content-Security-Policy headers directly in web server or middleware configuration, or using another CSP package that fits your framework version. This bundle makes sense when you want Symfony bundle configuration, nonce support, and reporting in one place and your app is already on a compatible Symfony 7 / Laravel 11+ stack. If you are pinned to Laravel 10 or Symfony 6.4, stay on the prior major or use a middleware-based approach until the framework upgrade is funded.
Weaver
How can I help you explore Laravel packages today?