yii2-secure-headers | Secure headers extension for your Yii2 application

yii2-secure-headers is a PHP library. yii2-secure-headers has no bugs, it has no vulnerabilities, it has a Permissive License and it has low support. You can download it from GitHub.

Wildcard, allows any URL except data: blob: filesystem: schemes. Prevents loading resources from any source. Allows loading resources from the same origin (same scheme, host and port). Allows loading resources via the data scheme (eg Base64 encoded images). Allows loading resources from the specified domain name. Allows loading resources from any subdomain under example.com. Allows loading resources only over HTTPS matching the given domain. Allows loading resources only over HTTPS on any domain. Allows use of inline source elements such as style attribute, onclick, or script tag bodies (depends on the context of the source it is applied to). Allows unsafe dynamic code evaluation such as JavaScript eval(). Each header has a reference link in config file, you should read it if you do not know the header. If you want to disable a string type header, just set to null or empty string. We use paragonie/csp-builder to help us support csp header. If you want to disable csp header, set custom-csp to empty string. If you want to require subresource integrity for style and script sources set requireSriForStyle and requireSriForScript to true. Deprecated. Use Permissions Policy instead. Feature Policy is being created to allow site owners to enable and disable certain web platform features on their own pages and those they embed. Use same directives as for CSP. Permissions Policy is new policy which will replace Feature Policy.