Content Security Policy (CSP) module for Silverstripe websites

Content Security Policy (CSP) is an added layer of security that helps to detect and mitigate certain types of attacks, including Cross Site Scripting (XSS) and data injection attacks. These attacks are used for everything from data theft to site defacement to distribution of malware.

Source: https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP

This module provides the ability to:

Create one or more CSP records within the administration area of your website and make one of those the base policy for use on the website
Set a CSP record to be report only
Collect CSP Violation reports internally via a controller or via a specific URL/service
Add page specific CSP records, which work with or without the base policy
Add a per-request nonce

Once a CSP is in place and working, any assets loads that do not meet policy requirements will be blocked from loading, with warnings similar to this in the browser dev console:

Refused to load the script 'https://badactor.example.com/eval.js' because it violates the following Content Security Policy directive: "script-src 'self' 'nonce-example' https://cdnjs.cloudflare.com/".

Versioning

This is the Silverstripe 4.x version of the module, with releases tagged as v0.2 and up

The Silverstripe 3.x version with releases tagged as v0.1. While none are planned, any future releases of the ss3 branch will remain at 0.1.x

Installation

The only supported method of installing this module is via composer:

composer require nswdpc/silverstripe-csp

Instructions

⚠️ An incorrectly implemented CSP can have negative effects for valid visitors to your website.

Read the initial documentation
Read the good-to-know section
Install the module on a development instance of your website and configure it
Add at least one Policy record in the "CSP" administration section.
- Set it to 'report only'
- Mark it as the 'base policy'
- Optionally, make it available on your draft site only
Set the policy to be delivered via a HTTP headers (you can use meta tags but this method limits the feature you can use).
Add some Directives
Mark the Policy 'Enabled', save it and
Watch for violation reports or look at your browser dev console

When you are pleased with the settings, check the "Use on published website" setting and save.

After UAT is complete, implement the same process on your production website. You should run the policy as report-only and monitor reports, initially.