Content Security Policy in Laravel Projects

The security of web applications is one of the key aspects that developers must pay attention to when creating new projects. One of the tools that can significantly enhance application security is Content Security Policy (CSP). CSP is a mechanism that allows restricting the sources of content that can be loaded and executed in a web application. This helps to effectively counter various attacks, such as cross-site scripting (XSS) or clickjacking. In this article, we will discuss how to implement CSP in Laravel projects, providing concrete examples and their applications.

What is Content Security Policy?

Content Security Policy is an HTTP header that allows web developers to specify which resources can be loaded and executed by the browser. It enables the definition of rules that determine from which domains scripts, styles, images, fonts, and other resources can be loaded. For instance, we can allow scripts to be loaded only from our domain and trusted sources, minimizing the risk of malicious code injection.

Implementing CSP in Laravel

Laravel, as one of the most popular PHP frameworks, offers various ways to integrate CSP into a project. We can do this manually by modifying HTTP headers or using ready-made packages that simplify the entire process.

Adding CSP Manually

The simplest way to add CSP to a Laravel project is by directly adding the appropriate HTTP headers. We can do this in the App\Http\Middleware\VerifyCsrfToken.php file by adding the following code:

namespace App\Http\Middleware;

use Closure;

class VerifyCsrfToken
{
    public function handle($request, Closure $next)
    {
        $response = $next($request);

        $response->headers->set('Content-Security-Policy', "default-src 'self'; script-src 'self' https://trusted.cdn.com; style-src 'self' https://trusted.cdn.com;");

        return $response;
    }
}

In the above example, we set a CSP policy that allows resources to be loaded only from our domain ('self') and from https://trusted.cdn.com for scripts and styles.

Using the spatie/laravel-csp Package

For more advanced configuration, it is worth using a ready-made package such as spatie/laravel-csp. This package offers a simple way to manage CSP policies.

To install the package, use the command:

composer require spatie/laravel-csp

Then publish the configuration files:

php artisan vendor:publish --provider="Spatie\Csp\CspServiceProvider"

After installing and publishing the configuration files, we can customize the CSP policy in the config/csp.php file:

return [
    'policy' => App\Policies\CustomCspPolicy::class,
];

Next, create our CSP policy in the app/Policies/CustomCspPolicy.php file:

namespace App\Policies;

use Spatie\Csp\Directive;
use Spatie\Csp\Policies\Policy;

class CustomCspPolicy extends Policy
{
    public function configure()
    {
        $this
            ->addDirective(Directive::DEFAULT_SRC, "'self'")
            ->addDirective(Directive::SCRIPT_SRC, ["'self'", "https://trusted.cdn.com"])
            ->addDirective(Directive::STYLE_SRC, ["'self'", "https://trusted.cdn.com"]);
    }
}

In this example, we configured the CSP policy similarly to the previous example but using the more flexible approach offered by the spatie/laravel-csp package.

Examples and Applications

Protection Against XSS

The most common use of CSP is to protect against XSS attacks, which involve injecting malicious JavaScript code into the application. With CSP, we can restrict the sources from which scripts can be loaded, significantly hindering such attacks.

Control Over Resource Loading

CSP also allows controlling the loading of other resources such as images, fonts, media, or frames. For instance, we can allow images to be loaded only from our domain and trusted CDN services:

$response->headers->set('Content-Security-Policy', "default-src 'self'; img-src 'self' https://trusted.cdn.com;");

Protection Against Clickjacking

CSP can also help protect against clickjacking attacks, which involve placing a page in an invisible frame to capture user interactions. We can achieve this by setting the appropriate CSP headers:

$response->headers->set('Content-Security-Policy', "frame-ancestors 'self';");

Conclusion

Content Security Policy is a powerful tool that can significantly enhance the security of web applications. Laravel offers various ways to integrate CSP into a project, from manually adding headers to using advanced packages like spatie/laravel-csp. With the appropriate CSP configuration, we can effectively protect our application from various threats such as XSS attacks, clickjacking, or unauthorized resource loading. It is worth investing time in implementing CSP in your projects to provide users with greater security and data protection.