{"id":20929171,"url":"https://github.com/toyokumo/ring-middleware-csp","last_synced_at":"2025-05-13T18:32:15.077Z","repository":{"id":41058372,"uuid":"281626518","full_name":"toyokumo/ring-middleware-csp","owner":"toyokumo","description":"Ring middleware for Content Security Policy","archived":false,"fork":false,"pushed_at":"2023-12-15T04:49:42.000Z","size":40,"stargazers_count":9,"open_issues_count":0,"forks_count":3,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-05-07T23:56:21.087Z","etag":null,"topics":["clojure","content-security-policy","csp","middleware","ring","ring-middleware"],"latest_commit_sha":null,"homepage":"","language":"Clojure","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/toyokumo.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null}},"created_at":"2020-07-22T08:56:42.000Z","updated_at":"2025-01-21T00:23:22.000Z","dependencies_parsed_at":"2024-01-05T21:53:47.569Z","dependency_job_id":null,"html_url":"https://github.com/toyokumo/ring-middleware-csp","commit_stats":{"total_commits":58,"total_committers":5,"mean_commits":11.6,"dds":0.1724137931034483,"last_synced_commit":"37ee947d5dd733a5566557f939be5e44309a0063"},"previous_names":[],"tags_count":6,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/toyokumo%2Fring-middleware-csp","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/toyokumo%2Fring-middleware-csp/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/toyokumo%2Fring-middleware-csp/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/toyokumo%2Fring-middleware-csp/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/toyokumo","download_url":"https://codeload.github.com/toyokumo/ring-middleware-csp/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":254003345,"owners_count":21997869,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["clojure","content-security-policy","csp","middleware","ring","ring-middleware"],"created_at":"2024-11-18T21:17:49.886Z","updated_at":"2025-05-13T18:32:14.740Z","avatar_url":"https://github.com/toyokumo.png","language":"Clojure","funding_links":[],"categories":[],"sub_categories":[],"readme":"# ring-middleware-csp\nRing middleware for Content Security Policy\n\n[![Lint and Test](https://github.com/toyokumo/ring-middleware-csp/actions/workflows/test.yml/badge.svg?branch=main)](https://github.com/toyokumo/ring-middleware-csp/actions/workflows/test.yml)\n[![cljdoc badge](https://cljdoc.org/badge/toyokumo/ring-middleware-csp)](https://cljdoc.org/d/toyokumo/ring-middleware-csp/CURRENT)\n[![Clojars Project](https://img.shields.io/clojars/v/toyokumo/ring-middleware-csp.svg)](https://clojars.org/toyokumo/ring-middleware-csp)\n[![License](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](https://opensource.org/licenses/Apache-2.0)\n\n## Installation\nTo install, add the following to your project `:dependencies`:\n\n[![Clojars Project](https://clojars.org/toyokumo/ring-middleware-csp/latest-version.svg)](https://clojars.org/toyokumo/ring-middleware-csp)\n\n## Usage\n\n```clojure\n(require '[ring-middleware-csp.core :refer [wrap-csp]]\n         '[ring.util.response :refer [response]])\n\n(defn handler [request]\n  (response {:foo \"bar\"}))\n\n(def policy {:default-src :none\n             :script-src [:self :nonce]\n             :style-src [\"https://example.com\" :unsafe-inline]\n             :block-all-mixed-content true\n             :report-uri \"/csp-report\"})\n\n(def app\n  (-\u003e handler\n      (wrap-csp {:policy policy})\n      (other-middleware)))\n```\nThen, Content-Security-Policy header is added to http response.\n\nHandlers created by `wrap-csp` support 3-arity versions for asynchronous use.\n\n### Use nonce\nYou can use nonce by setting `use-nonce?` option to `true`. \n`wrap-csp` middleware inject `:csp-nonce` to request map.\nYou can use nonce like following.\n```clojure\n(defn handler [{:keys [csp-nonce] :as req}]\n  {:status 200\n   :headers {}\n   :body (str \"\u003cscript nonce=\\\"\" csp-nonce \"\\\"\u003ealert('foo');\u003c/script\u003e\")})\n```\n\n### Get header value from policy map\nYou can use `compose` function.\n```clojure\n(ring-middleware-csp.core/compose {:default-src :none\n                                   :style-src [\"https://example.com\" :unsafe-inline]\n                                   :block-all-mixed-content true\n                                   :report-uri \"/csp-report\"})\n=\u003e \"default-src 'none';style-src https://example.com 'unsafe-inline';block-all-mixed-content;report-uri /csp-report\"\n\n; with nonce\n(ring-middleware-csp.core/compose {:default-src :none\n                                   :style-src [:nonce :unsafe-inline]}\n                                  \"abcdefg\")\n\n=\u003e \"default-src 'none';style-src 'nonce-abcdefg' 'unsafe-inline'\"\n```\n\n## Options\n### `:policy`\nSpecify Content-Security-Policy value.\nThe key of map is the directive name, the value of map is the directive value.\nValues are keyword, string or collection of them.\n\ne.g.\n```clojure\n{:policy {:default-src :none\n          :script-src [:self :nonce]\n          :style-src [\"https://example.com\" :unsafe-inline]\n          :report-uri \"/csp-report\"}}\n```\n\n### `:report-only?`\nIf `:report-only?` is set to true, use \"Content-Security-Policy-Report-Only\" as header name.\n\n### `:policy-generator`\nBy setting a function in `:policy-generator`, you can set a dynamic policy according to the request.\nThe argument of the function is ring request map, the return value of it is policy map (same style as `:policy`).\nIf the function returns `nil`, use default policy.\n\n### `:report-handler` and `:report-uri`\nBy using `:report-handler`, you can handle report request.\n`:report-uri` is the path to use report-handler.\n`:report-handler` is ring-style report handler (you must return valid response map).\nIf use `:report-handler` or `:report-uri`, must set both `:report-handler` and `:report-uri`.\n\nWARN: `:report-uri` option and `:report-uri` directive in `:policy` is independent config.\nEven if you set `:report-uri` option, the report-uri directive is NOT added automatically.\n\ne.g.\n```clojure\n{:policy {:default-src :self\n          :report-uri \"/csp-report\"}\n :report-uri \"/csp-report\"\n :report-handler (fn [req]\n                   (response {:foo \"bar\"}))}\n```\n\n### `:use-nonce?`\nThe default value is `false`.\nIf you set to `true`, enable to generate nonce.\n\n### `:nonce-generator`\nBy using `:nonce-generator`, you can use custom nonce generator.\nDefault generator use [`SecureRandom`](https://docs.oracle.com/javase/8/docs/api/java/security/SecureRandom.html) (using \"NativePRNGNonBlocking\" algorithm\nor, on MS-Windows, the [default implementation](https://docs.oracle.com/javase/8/docs/technotes/guides/security/SunProviders.html#SecureRandomImp)) and\n[`java.util.Base64`](https://docs.oracle.com/javase/8/docs/api/java/util/Base64.html).\nIt generates base64 string from 256bit random data.\n\ne.g.\n```clojure\n{:policy {:default-src :self\n          :script-src [:self :nonce]}\n :nonce-generator (fn []\n                    \"STATIC-NONCE\")} ; DON'T use static nonce for security reason\n```\n\n## Testing\n```\nclojure -M:dev:test\n```\n\n## Formatting\nUse [cljstyle](https://github.com/greglook/cljstyle).\n```\ncljstyle fix\n```\n\n## License\n\nCopyright 2020 Toyokumo,Inc.\n\nLicensed under the Apache License, Version 2.0 (the \"License\");\nyou may not use this file except in compliance with the License.\nYou may obtain a copy of the License at\n\n    http://www.apache.org/licenses/LICENSE-2.0\n\nUnless required by applicable law or agreed to in writing, software\ndistributed under the License is distributed on an \"AS IS\" BASIS,\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\nSee the License for the specific language governing permissions and\nlimitations under the License.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftoyokumo%2Fring-middleware-csp","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Ftoyokumo%2Fring-middleware-csp","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftoyokumo%2Fring-middleware-csp/lists"}