Weave Code
Laravel Csp Laravel Package
spatie/laravel-csp
Add Content Security Policy (CSP) headers to your Laravel app with easy configuration and preset policies. Control which scripts, styles, images, and connections are allowed, reduce XSS/data exfiltration risk, and support reporting and nonces.
Set content security policy headers in a Laravel app
Frequently asked questions about Laravel Csp
- How do I install spatie/laravel-csp in a Laravel 9/10 project?
- Run `composer require spatie/laravel-csp` in your project directory. The package auto-discovers and publishes its config file. No additional setup is required unless you need custom directives or middleware adjustments.
- Does this package support Laravel Octane (Swoole/RoadRunner)?
- Yes, the package explicitly supports Octane via scoped singletons (introduced in v3.23.1). This ensures thread-safe CSP header generation in high-concurrency environments, but test nonce collisions under load if using dynamic content.
- Can I use this package with Livewire or Inertia.js in Octane?
- Yes, but dynamic nonces may require extra validation. Ensure Livewire/Inertia scripts are explicitly allowed in your CSP directives (e.g., `script-src 'self' 'nonce-{nonce}'`). Test in Octane’s async context for nonce leakage.
- How do I configure CSP directives for a Laravel app?
- Edit the `config/csp.php` file published by the package. Define directives like `default-src`, `script-src`, and `style-src` using placeholders like `{nonce}` for dynamic content. Use `csp:directive()` in middleware or controllers for runtime adjustments.
- What happens if a CSP violation occurs in Octane?
- Violations are logged via Laravel’s default logging system. In Octane, ensure structured logging is configured to capture async worker events. Violations won’t block requests but help audit security risks.
- Are there performance tradeoffs for using scoped singletons in non-Octane Laravel?
- No, the scoped singleton pattern is backward-compatible with traditional PHP-FPM. It only optimizes nonce generation under concurrent requests, which is irrelevant in single-process environments. No performance impact is expected.
- How do I test CSP headers in a Laravel application?
- Use browser dev tools (Network tab) to inspect `Content-Security-Policy` headers. For automated testing, assert headers in PHPUnit with `$response->headers->get('Content-Security-Policy')`. Test violation reports with `report-uri` directives.
- What Laravel versions does spatie/laravel-csp support?
- The package supports Laravel 8+, with explicit Octane compatibility for Laravel 8.60+. Test thoroughly in Laravel 9/10 for framework-level CSP header changes, though no breaking updates are expected.
- Can I use this package with a custom middleware stack?
- Yes, but ensure the CSP middleware runs at the correct priority. Use `$stack->prepend()` for early execution (e.g., before auth) or `$stack->push()` for later. Conflicts may arise if other middleware modifies headers post-CSP.
- What alternatives exist for CSP in Laravel?
- Alternatives include manual header injection via `Response::header()` or packages like `league/csp`. However, `spatie/laravel-csp` offers deeper Laravel integration, nonce support, and Octane compatibility out of the box.
Weaver
How can I help you explore Laravel packages today?