3

I want to set Content-Security-Policy header in my site.

I found a module to set CSP (I have not tried it yet). But I want to know is there any option available in drupal 8 core itself to set CSP.

Improve this question
2
  • i set it in nginx config since it has nothing to do with drupal itself. but you could simply alter the page headers via hook_attachments(i think) and add a new header.
    – user21641
    Commented Jun 22, 2018 at 9:59
  • There might be. There is stuff for CORS (drupal.org/node/2715637). I am actually working on this stuff right now.
    – Patrick
    Commented Jul 18, 2018 at 13:29

1 Answer 1

Reset to default
6

I may be a bit biased in thinking that the Content Security Policy module is the best solution for adding a policy to your site, but here are some of the reasons for using the module:

  • Integration with the Libraries API to automatically generate script and style directives
  • An admin interface that validates your policy configuration
  • Provides a reporting endpoint to receive policy violations and add them to your site log, so you don't need to use an external service like Report-URI.com (but it also provides a plugin to use it, if you do).
    The Reporting API module is still in beta, but it will have improvements over CSP's reporting handler, and has a plugin to integrate with CSP module.
  • Some optimizations to shorten your policy where possible (e.g. If a fetch directive like img-src that falls back to default-src has the same value, it is omitted)
  • In the future modules will be able to integrate with CSP module to alter the policy as needed (enabling additional directives, altering the policy per-page)

There are a couple alternatives to the CSP module, if you don't want all of these additional features:

  • The Security Kit module allows adding a CSP policy header, but it only allows either an enforced or report-only policy, and it does not have fields for many newer directives.
  • The HTTP Response Headers module allows you to configure a static value for any HTTP header you want
  • Set a static header in your own response event subscriber in a custom module.
  • You can set the header directly in Apache or nginx configuration
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.