CSP in PHP

CSP stands for Content Security Policy. It is an additional layer of security. In this case, we will see how to apply CSP in PHP.

CSP allows us to disable the loading of various types of scripts, CSS, files, etc.; as well as enable them.

The main reason for the existence of CSP is to try to prevent Cross Site Scripting (XSS).

Having a CSP on your page will significantly reduce the attack on your website.

Directives

CSP has many directives that we can use, which allow us to define where we are applying a limitation or allowing an action.

The directives determine what procedures or actions will be performed with respect to a given URL.

We can see all the directives at https://content-security-policy.com/

Let’s see the most used directives

Tools that can help us create our CSP

Tools:

• inspector (herramienta del navegador firefox)
• https://csp-evaluator.appspot.com/ o similar

How to use the inspector:

It’s simple.

1. Open the Firefox inspector by right-clicking on the page and selecting “Inspect Element”.

Once the inspector is open, you need to know how to obtain your CSP.

To obtain your CSP:

1. Go to the Network tab.
2. Reload the page and look for the first GET request in the Network tab.
3. Click on the Headers tab.
4. In the Headers tab, look for the Content-Security-Policy header and its value.
5. Copy the value of the Content-Security-Policy header and paste it into the CSP Evaluator.

The CSP Evaluator will help you to evaluate your CSP header and identify any potential security risks.

Create the CSP in PHP

For PHP, we can use the header function to create our content security policy (CSP). My recommendation is to put it inside a function and then use it directly in our header. Or, if we are using WordPress, we can use something like:

add_action('wp_headers', 'add_content_security_policy_header',1);

function add_content_security_policy_header() {
    global $nonce;
	header("Content-Security-Policy:".
	"default-src 'self' ".
		"https://*.web1.com/ ".
		"https://www.web2.com; ".
	"script-src ".
		base()." ".
		"'nonce-$nonce'; ".
	"style-src 'self' ". 
		"'unsafe-inline' ".
		"'nonce-".$nonce."'; ".
	"img-src 'self' ".
		"https://* data: ; ".
	"font-src 'self' ".
		"data: ".
		"https://ka-f.fontawesome.com; ".
	"connect-src 'self' ".
		"https://www.google-analytics.com ".
		"https://*.googlesyndication.com/ ".
		"https://www.google.com/ ".
		"https://fundingchoicesmessages.google.com ".
		"https://ka-f.fontawesome.com/; ".
	"base-uri 'self'; ".
		"");
}