{"repo":"spatie/laravel-csp","free":true,"listed":false,"github":"https://github.com/spatie/laravel-csp","clone":"git clone https://github.com/spatie/laravel-csp.git","description":"Set content security policy headers in a Laravel app","language":"PHP","stars":870,"topics":["laravel","security","csp","request","http"],"license":"MIT","category":"security-tools","readme_excerpt":"Set content security policy headers in a Laravel app By default, all scripts on a webpage are allowed to send and fetch data to any site they want. This can be a security problem. Imagine one of your JavaScript dependencies sends all keystrokes, including passwords, to a third party website. It's very easy for someone to hide this malicious behaviour, making it nearly impossible for you to detect it (unless you manually read all the JavaScript code on your site). For a better idea of why you really need to set content security policy headers, read this excellent blog post by David Gilbertson. Setting Content Security Policy headers helps solve this problem. These headers dictate which sites your site is allowed to contact. This package makes it easy for you to set the right headers. This readme does not aim to fully explain all the possible usages of CSP and its directives. We highly recommend that you read Mozilla's documentation on the Content Security Policy before using this package. Another good resource to learn about CSP, is this edition of the Larasec newsletter by Stephen Rees-Carter. Support us We invest a lot of resources into creating best in class open source packages. You can support us by buying one of our paid products. We highly appreciate you sending us a postcard from your hometown, mentioning which of our package(s) you are using. You'll find our address on our contact page. We publish all received postcards on our virtual postcard wall. Installation You c","default_branch":null,"files":null,"tree":[],"storefront":"/r/spatie","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/spatie/laravel-csp/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}