Class SecurityHeadersMiddleware
Handles common security headers in a convenient way
Link: https://book.cakephp.org/5/en/controllers/middleware.html#security-header-middleware
Constants
-
stringALL ¶'all' -
stringALLOW_FROM ¶'allow-from' -
stringBY_CONTENT_TYPE ¶'by-content-type' -
stringBY_FTP_FILENAME ¶'by-ftp-filename' -
stringDENY ¶'deny' -
stringMASTER_ONLY ¶'master-only' -
stringNONE ¶'none' -
stringNOOPEN ¶'noopen' -
stringNOSNIFF ¶'nosniff' -
stringNO_REFERRER ¶'no-referrer' -
stringNO_REFERRER_WHEN_DOWNGRADE ¶'no-referrer-when-downgrade' -
stringORIGIN ¶'origin' -
stringORIGIN_WHEN_CROSS_ORIGIN ¶'origin-when-cross-origin' -
stringSAMEORIGIN ¶'sameorigin' -
stringSAME_ORIGIN ¶'same-origin' -
stringSTRICT_ORIGIN ¶'strict-origin' -
stringSTRICT_ORIGIN_WHEN_CROSS_ORIGIN ¶'strict-origin-when-cross-origin' -
stringUNSAFE_URL ¶'unsafe-url' -
stringXSS_BLOCK ¶'block' -
stringXSS_DISABLED ¶'0' -
stringXSS_ENABLED ¶'1' -
stringXSS_ENABLED_BLOCK ¶'1; mode=block'
Property Summary
-
$headers protected
array<string, mixed>Security related headers to set
Method Summary
-
checkValues() protected
Convenience method to check if a value is in the list of allowed args
-
noOpen() public
X-Download-Options
-
noSniff() public
X-Content-Type-Options
-
process() public
Serve assets if the path matches one.
-
setCrossDomainPolicy() public
X-Permitted-Cross-Domain-Policies
-
setPermissionsPolicy() public
Permissions Policy
-
setReferrerPolicy() public
Referrer-Policy
-
setXFrameOptions() public
X-Frame-Options
-
setXssProtection() public
X-XSS-Protection. It's a non standard feature and outdated. For modern browsers use a strong Content-Security-Policy that disables the use of inline JavaScript via 'unsafe-inline' option.
Method Detail
checkValues() ¶ protected
checkValues(string $value, list<string> $allowed): voidConvenience method to check if a value is in the list of allowed args
Parameters
-
string$value Value to check
-
list<string>$allowed List of allowed values
Returns
voidThrows
InvalidArgumentExceptionThrown when a value is invalid.
noOpen() ¶ public
noOpen(): $thisX-Download-Options
Sets the header value for it to 'noopen'
Returns
$thisLinks
noSniff() ¶ public
noSniff(): $thisX-Content-Type-Options
Sets the header value for it to 'nosniff'
Returns
$thisLinks
process() ¶ public
process(ServerRequestInterface $request, RequestHandlerInterface $handler): Psr\Http\Message\ResponseInterfaceServe assets if the path matches one.
Processes an incoming server request in order to produce a response. If unable to produce the response itself, it may delegate to the provided request handler to do so.
Parameters
-
ServerRequestInterface$request The request.
-
RequestHandlerInterface$handler The request handler.
Returns
Psr\Http\Message\ResponseInterfacesetCrossDomainPolicy() ¶ public
setCrossDomainPolicy(string $policy = self::ALL): $thisX-Permitted-Cross-Domain-Policies
Parameters
-
string$policy optional Policy value. Available Values: 'all', 'none', 'master-only', 'by-content-type', 'by-ftp-filename'
Returns
$thisLinks
setPermissionsPolicy() ¶ public
setPermissionsPolicy(string $policy): $thisPermissions Policy
Parameters
-
string$policy Policy value.
Returns
$thisLinks
https://www.w3.org/TR/permissions-policy/
setReferrerPolicy() ¶ public
setReferrerPolicy(string $policy = self::SAME_ORIGIN): $thisReferrer-Policy
Parameters
-
string$policy optional Policy value. Available Value: 'no-referrer', 'no-referrer-when-downgrade', 'origin', 'origin-when-cross-origin', 'same-origin', 'strict-origin', 'strict-origin-when-cross-origin', 'unsafe-url'
Returns
$thisLinks
setXFrameOptions() ¶ public
setXFrameOptions(string $option = self::SAMEORIGIN, string|null $url = null): $thisX-Frame-Options
Parameters
-
string$option optional Option value. Available Values: 'deny', 'sameorigin', 'allow-from
' -
string|null$url optional URL if mode is
allow-from
Returns
$thisLinks
setXssProtection() ¶ public
setXssProtection(string $mode = self::XSS_BLOCK): $thisX-XSS-Protection. It's a non standard feature and outdated. For modern browsers use a strong Content-Security-Policy that disables the use of inline JavaScript via 'unsafe-inline' option.
Parameters
-
string$mode optional Mode value. Available Values: '1', '0', 'block'
Returns
$this