{"id":15282322,"url":"https://github.com/hyperia-sk/yii2-secure-headers","last_synced_at":"2025-07-13T17:38:13.404Z","repository":{"id":21980030,"uuid":"94620639","full_name":"hyperia-sk/yii2-secure-headers","owner":"hyperia-sk","description":"Secure headers extension for your Yii2 application","archived":false,"fork":false,"pushed_at":"2025-03-20T13:15:24.000Z","size":130,"stargazers_count":21,"open_issues_count":3,"forks_count":8,"subscribers_count":3,"default_branch":"master","last_synced_at":"2025-04-09T19:16:46.283Z","etag":null,"topics":["headers","https","secure","secure-headers","security","subresource-integrity","yii","yii2","yii2-extension"],"latest_commit_sha":null,"homepage":"","language":"PHP","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/hyperia-sk.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE.md","code_of_conduct":"CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2017-06-17T11:51:35.000Z","updated_at":"2025-03-20T13:14:15.000Z","dependencies_parsed_at":"2022-07-27T02:47:36.282Z","dependency_job_id":null,"html_url":"https://github.com/hyperia-sk/yii2-secure-headers","commit_stats":null,"previous_names":[],"tags_count":14,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/hyperia-sk%2Fyii2-secure-headers","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/hyperia-sk%2Fyii2-secure-headers/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/hyperia-sk%2Fyii2-secure-headers/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/hyperia-sk%2Fyii2-secure-headers/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/hyperia-sk","download_url":"https://codeload.github.com/hyperia-sk/yii2-secure-headers/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248094988,"owners_count":21046770,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["headers","https","secure","secure-headers","security","subresource-integrity","yii","yii2","yii2-extension"],"created_at":"2024-09-30T14:25:08.912Z","updated_at":"2025-04-09T19:16:51.101Z","avatar_url":"https://github.com/hyperia-sk.png","language":"PHP","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Yii2 security headers extension\n\n[![Build Status](https://travis-ci.org/hyperia-sk/yii2-secure-headers.svg?branch=master)](https://travis-ci.org/hyperia-sk/yii2-secure-headers) \n[![codecov](https://codecov.io/gh/hyperia-sk/yii2-secure-headers/branch/master/graph/badge.svg)](https://codecov.io/gh/hyperia-sk/yii2-secure-headers)\n[![GitHub license](https://img.shields.io/badge/license-MIT-blue.svg)](https://raw.githubusercontent.com/hyperia-sk/yii2-secure-headers/master/LICENSE) \n[![Latest Stable Version](https://poser.pugx.org/hyperia/yii2-secure-headers/v/stable)](https://packagist.org/packages/hyperia/yii2-secure-headers)\n\n\u003e Add security related headers to HTTP response. The package includes extension for easy Yii2 integration.\n\n## Installation\n\nThe preferred way to install this extension is through [composer](http://getcomposer.org/download/).\n\nEither run\n\n```shell\ncomposer require hyperia/yii2-secure-headers:\"^2.0\"\n```\n\nor add\n\n```\n\"hyperia/yii2-secure-headers\": \"^2.0\"\n```\n\nto the require section of your composer.json.\n\n## Configuration (usage)\n\n```php\n'bootstrap'  =\u003e [..., 'headers'],\n'components' =\u003e [\n    ...\n    'headers' =\u003e [\n        'class' =\u003e '\\hyperia\\security\\Headers',\n        'upgradeInsecureRequests' =\u003e true,\n        'blockAllMixedContent' =\u003e true,\n        'requireSriForScript' =\u003e false,\n        'requireSriForStyle' =\u003e false,\n        'xssProtection' =\u003e true,\n        'contentTypeOptions' =\u003e true,\n        'strictTransportSecurity' =\u003e [\n            'max-age' =\u003e 10,\n            'includeSubDomains' =\u003e true,\n            'preload' =\u003e false\n        ],\n        'xFrameOptions' =\u003e 'DENY',\n        'xPoweredBy' =\u003e 'Hyperia',\n        'referrerPolicy' =\u003e 'no-referrer',\n        'reportOnlyMode' =\u003e false\n        'reportUri' =\u003e 'https://company.report-uri.com/r/d/csp/enforce',\n        'reportTo' =\u003e [\n            [\n                'group' =\u003e 'groupName',\n                'max_age' =\u003e 10886400,\n                'endpoints' =\u003e [\n                    [\n                        'name' =\u003e 'endpointName',\n                        'url' =\u003e 'https://example.com',\n                        'failures' =\u003e 1\n                    ]\n                ]\n            ]\n        ]\n        'cspDirectives' =\u003e [\n            'connect-src' =\u003e \"'self'\",\n            'font-src' =\u003e \"'self'\",\n            'frame-src' =\u003e \"'self'\",\n            'img-src' =\u003e \"'self' data:\",\n            'manifest-src' =\u003e \"'self'\",\n            'object-src' =\u003e \"'self'\",\n            'prefetch-src' =\u003e false,\n            'script-src' =\u003e \"'self' 'unsafe-inline'\",\n            'style-src' =\u003e \"'self' 'unsafe-inline'\",\n            'media-src' =\u003e \"'self'\",\n            'form-action' =\u003e \"'self'\",\n            'worker-src' =\u003e \"'self'\",\n            'report-to' =\u003e 'groupname'\n        ],\n        // Deprecated. Use Permissions Policy instead.\n        'featurePolicyDirectives' =\u003e [\n            'accelerometer' =\u003e \"'self'\",\n            'ambient-light-sensor' =\u003e \"'self'\",\n            'autoplay' =\u003e \"'self'\",\n            'battery' =\u003e \"'self'\",\n            'camera' =\u003e \"'self'\",\n            'display-capture' =\u003e \"'self'\",\n            'document-domain' =\u003e \"'self'\",\n            'encrypted-media' =\u003e \"'self'\",\n            'fullscreen' =\u003e \"'self'\",\n            'geolocation' =\u003e \"'self'\",\n            'gyroscope' =\u003e \"'self'\",\n            'layout-animations' =\u003e \"'self'\",\n            'magnetometer' =\u003e \"'self'\",\n            'microphone' =\u003e \"'self'\",\n            'midi' =\u003e \"'self'\",\n            'oversized-images' =\u003e \"'self'\",\n            'payment' =\u003e \"'self'\",\n            'picture-in-picture' =\u003e \"*\",\n            'publickey-credentials-get' =\u003e \"'self'\",\n            'sync-xhr' =\u003e \"'self'\",\n            'usb' =\u003e \"'self'\",\n            'wake-lock' =\u003e \"'self'\",\n            'xr-spatial-tracking' =\u003e \"'self'\"\n        ],\n        'permissionsPolicyDirectives' =\u003e [\n            'accelerometer' =\u003e \"self\",\n            'ambient-light-sensor' =\u003e \"self\",\n            'autoplay' =\u003e \"self\",\n            'battery' =\u003e \"self\",\n            'camera' =\u003e \"self\",\n            'display-capture' =\u003e \"self\",\n            'document-domain' =\u003e \"self\",\n            'encrypted-media' =\u003e \"self\",\n            'fullscreen' =\u003e \"self\",\n            'geolocation' =\u003e \"self\",\n            'gyroscope' =\u003e \"self\",\n            'layout-animations' =\u003e \"self\",\n            'magnetometer' =\u003e \"self\",\n            'microphone' =\u003e \"self\",\n            'midi' =\u003e \"self\",\n            'oversized-images' =\u003e \"self\",\n            'payment' =\u003e \"self\",\n            'picture-in-picture' =\u003e \"*\",\n            'publickey-credentials-get' =\u003e \"self\",\n            'sync-xhr' =\u003e \"self\",\n            'usb' =\u003e \"self\",\n            'wake-lock' =\u003e \"self\",\n            'xr-spatial-tracking' =\u003e \"self\"\n        ]\n    ]\n]\n```\n\n## Parameter description\n\n| Source Value       | Example                    | Description                                                                                                                                         |\n|--------------------|----------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------|\n| *                  | img-src *                  | Wildcard, allows any URL except data: blob: filesystem: schemes.                                                                                    |\n| 'none'             | object-src 'none'          | Prevents loading resources from any source.                                                                                                         |\n| 'self'             | script-src 'self'          | Allows loading resources from the same origin (same scheme, host and port).                                                                         |\n| data:              | img-src 'self' data:       | Allows loading resources via the data scheme (eg Base64 encoded images).                                                                            |\n| domain.example.com | img-src domain.example.com | Allows loading resources from the specified domain name.                                                                                            |\n| *.example.com      | img-src *.example.com      | Allows loading resources from any subdomain under example.com.                                                                                      |\n| https://cdn.com    | img-src https://cdn.com    | Allows loading resources only over HTTPS matching the given domain.                                                                                 |\n| https:             | img-src https:             | Allows loading resources only over HTTPS on any domain.                                                                                             |\n| 'unsafe-inline'    | script-src 'unsafe-inline' | Allows use of inline source elements such as style attribute, onclick, or script tag bodies (depends on the context of the source it is applied to) |\n| 'unsafe-eval'      | script-src 'unsafe-eval'   | Allows unsafe dynamic code evaluation such as JavaScript eval()                                                                                     |\n| false              | prefetch-src false         | Exclude the property from the directive array to avoid deprecated warning/error from browsers                                                       |\n\n#### Policy\n\nEach header has a reference link in config file, you should read it if you do not know the header. \nIf you want to disable a string type header, just set to null or empty string.\n\n#### Content Security Policy\n\nWe use paragonie/csp-builder to help us support csp header. \nIf you want to disable csp header, set custom-csp to empty string.\n\n#### Subresource Integrity\n\nIf you want to require subresource integrity for style and script sources set `requireSriForStyle` and `requireSriForScript` to `true`\n\n#### Feature Policy\n**Deprecated. Use Permissions Policy instead.** Feature Policy is being created to allow site owners to enable and disable certain web platform features on their own pages and those they embed. Use same directives as for CSP\n\n#### Permissions Policy\nPermissions Policy is new policy which will replace Feature Policy\n\n#### Additional Resources\n\n[Everything you need to know about HTTP security headers](https://blog.appcanary.com/2017/http-security-headers.html)\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fhyperia-sk%2Fyii2-secure-headers","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fhyperia-sk%2Fyii2-secure-headers","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fhyperia-sk%2Fyii2-secure-headers/lists"}