Weave Code
Laravel Csp Laravel Package
spatie/laravel-csp
Set Content Security Policy (CSP) headers in Laravel to control which scripts, styles, and resources can load and where they can send data. Helps prevent XSS and malicious third-party scripts. Includes report-only mode, nonces, and easy config.
Set content security policy headers in a Laravel app
Frequently asked questions about Laravel Csp
- How do I install and enable spatie/laravel-csp in a Laravel 10+ project?
- Run `composer require spatie/laravel-csp`, publish the config with `php artisan vendor:publish --tag=csp-config`, then enable the middleware globally in `bootstrap/app.php` or per-route. The package auto-generates CSP headers after configuration.
- Does this package support report-only mode for testing CSP policies before enforcement?
- Yes. Use `report_only_presets` in your `config/csp.php` to test policies without blocking resources. Violations appear in browser console logs or via `report_uri` integration. Switch to enforcement later by removing `report_only_`.
- Can I use nonces for inline scripts/styles without breaking CSP?
- Absolutely. The package includes a built-in `RandomString` nonce generator. Enable it in `config/csp.php` with `nonce_enabled: true`, then inject `@cspNonce` into Blade directives or use JavaScript to append nonces dynamically.
- What Laravel versions does spatie/laravel-csp support, and will it work with Laravel 11?
- The package is compatible with Laravel 10+. While the last release was in 2026, Spatie maintains backward compatibility. Check the [GitHub releases](https://github.com/spatie/laravel-csp/releases) for Laravel 11 support, or test with `composer require spatie/laravel-csp:dev-main`.
- How do I handle third-party services like Google Analytics or Stripe in CSP?
- Use pre-built presets like `google`, `stripe`, or `posthog` in `config/csp.php`. For custom services, define a new preset under `presets` and include it in your `directives`. Example: `'presets' => ['google', 'custom-service']`.
- Will CSP headers break my existing jQuery plugins or legacy iframes?
- Potentially. Start with `report_only` mode to identify violations. For jQuery, use nonces or `unsafe-inline` as a last resort. Iframes may need `frame-src` directives or `allow='sameorigin'`. Audit dependencies with browser dev tools.
- How do I monitor CSP violations in production?
- Configure `report_uri` or `report_to` in `config/csp.php` to send violations to services like Report URI or Sentry. Example: `'report_uri' => 'https://your-report-uri.com/report'`. Use the dashboard to track and resolve issues.
- Can I use this package with SPAs (Vue/React) or hybrid apps like Inertia.js?
- Yes, but SPAs require client-side CSP handling. For Inertia.js, use `@cspMetaTag` in Blade layouts to proxy headers. Ensure dynamic content (e.g., inline scripts) uses nonces. Test thoroughly in development with `report_only`.
- What’s the performance impact of CSP headers and reporting?
- CSP headers add negligible overhead. Reporting (`report_uri`) may introduce latency if misconfigured or overloaded. Use CDN-based reporting services (e.g., Report URI) to minimize impact. Test under load before production.
- Are there alternatives to spatie/laravel-csp for Laravel CSP implementation?
- Yes. Alternatives include `nesbot/csp` (PHP library, no Laravel integration) or manual middleware. However, Spatie’s package offers Laravel-native features like Blade directives, presets, and seamless middleware integration. It’s the most developer-friendly for Laravel apps.
Weaver
How can I help you explore Laravel packages today?