@@ -34,22 +34,19 @@ Then proceed to configuration.
34
34
Configuration <a name =" configuration " ></a >
35
35
------------
36
36
37
+ The version 1.1 is a Module implementation.
37
38
38
- > ** IMPORTANT:** If you don't setup your configuration no header will be sent.
39
-
40
-
41
- An example of configuration:
42
-
39
+ Module _ securityHeader_ sample configuration in main.php
43
40
44
41
45
- Class Response configuration in main.php
46
-
47
42
``` php
48
43
[
49
- 'components' => [
50
- 'response' => [
51
- 'class' => 'bicf\securityheaders\components\Response',
52
- 'on afterPrepare' => ['bicf\securityheaders\components\Response','addSecurityHeaders'],
44
+ 'bootstrap'=>[
45
+ 'securityHeader',
46
+ ],
47
+ 'modules' => [
48
+ 'securityHeader' => [
49
+ 'class' => bicf\securityheaders\Module::class,
53
50
'modules' => [
54
51
'XContentTypeOptions'=>[
55
52
'class' => 'bicf\securityheaders\modules\HeaderXContentTypeOptions',
@@ -95,8 +92,12 @@ Class Response configuration in main.php
95
92
],
96
93
],
97
94
],
98
- ]
99
95
96
+ 'components' => [
97
+ // components stuff
98
+ // no need to add anything
99
+ ],
100
+ ]
100
101
```
101
102
102
103
@@ -252,3 +253,67 @@ public function actionIndex() {
252
253
253
254
254
255
256
+
257
+ Legacy Implementation <a name="legacy_configuration"></a>
258
+ --------------------
259
+
260
+ This is the old implementation, extending the Request Class.
261
+
262
+ > **IMPORTANT:** If you don't setup your configuration no header will be sent.
263
+
264
+ An example of configuration:
265
+
266
+ ` ` ` php
267
+ [
268
+ ' components' => [
269
+ ' response' => [
270
+ ' class' => ' bicf\s ecurityheaders\c omponents\R esponse' ,
271
+ ' on afterPrepare' => [' bicf\s ecurityheaders\c omponents\R esponse' ,' addSecurityHeaders' ],
272
+ ' modules' => [
273
+ ' XContentTypeOptions' => [
274
+ ' class' => ' bicf\s ecurityheaders\m odules\H eaderXContentTypeOptions' ,
275
+ ' value' => ' nosniff' ,
276
+ ],
277
+ ' AccessControlAllowMethods' => [
278
+ ' class' => ' bicf\s ecurityheaders\m odules\H eaderAccessControlAllowMethods' ,
279
+ ' value' => ' GET' ,
280
+ ],
281
+ ' AccessControlAllowOrigin' => [
282
+ ' class' => ' bicf\s ecurityheaders\m odules\H eaderAccessControlAllowOrigin' ,
283
+ ' value' => ' https://api.example.com' ,
284
+ ],
285
+ ' ContentSecurityPolicyAcl' => [
286
+ ' class' => ' bicf\s ecurityheaders\m odules\H eaderContentSecurityPolicyAcl' ,
287
+ ' enabled' => false ,
288
+ ' policies' => [
289
+ ' default-src' => " 'self'" ,
290
+ ' frame-src' => " 'self' www.facebook.com www.youtube.com www.google.com" ,
291
+ ' img-src' => " 'self' www.google-analytics.com" ,
292
+ ' font-src' => " 'self' fonts.gstatic.com maxcdn.bootstrapcdn.com" ,
293
+ ' media-src' => " 'self'" ,
294
+ ' script-src' => " 'self' www.google-analytics.com" ,
295
+ ' style-src' => " 'self' maxcdn.bootstrapcdn.com" ,
296
+ ' connect-src' => " 'self'" ,
297
+ ' report-uri' => " /report-csp-acl" ,
298
+ ],
299
+ ],
300
+ ' ContentSecurityPolicyMonitor' => [
301
+ ' class' => ' bicf\s ecurityheaders\m odules\H eaderContentSecurityPolicyMonitor' ,
302
+ ' policies' => [
303
+ ' default-src' => " 'self'" ,
304
+ ' frame-src' => " 'self' www.facebook.com www.youtube.com www.google.com" ,
305
+ ' img-src' => " 'self' www.google-analytics.com" ,
306
+ ' font-src' => " 'self' fonts.gstatic.com maxcdn.bootstrapcdn.com" ,
307
+ ' media-src' => " 'self'" ,
308
+ ' script-src' => " 'self' www.google-analytics.com" ,
309
+ ' style-src' => " 'self' maxcdn.bootstrapcdn.com" ,
310
+ ' connect-src' => " 'self'" ,
311
+ ' report-uri' => " /report-csp-acl" ,
312
+ ],
313
+ ],
314
+ ],
315
+ ],
316
+ ],
317
+ ]
318
+
319
+ ` ` `
0 commit comments