| Fully Qualified Name: | CodeIgniter\HTTP\ContentSecurityPolicy |
Class ContentSecurityPolicy
Provides tools for working with the Content-Security-Policy header to help defeat XSS attacks.
| Name | Description | Defined By |
|---|---|---|
| __construct() | ContentSecurityPolicy constructor. | ContentSecurityPolicy |
| addBaseURI() | Adds a new base_uri value. Can be either a URI class or a simple string. | ContentSecurityPolicy |
| addChildSrc() | Adds a new valid endpoint for a form's action. Can be either a URI class or a simple string. | ContentSecurityPolicy |
| addConnectSrc() | Adds a new valid endpoint for a form's action. Can be either a URI class or a simple string. | ContentSecurityPolicy |
| addFontSrc() | Adds a new valid endpoint for a form's action. Can be either a URI class or a simple string. | ContentSecurityPolicy |
| addFormAction() | Adds a new valid endpoint for a form's action. Can be either a URI class or a simple string. | ContentSecurityPolicy |
| addFrameAncestor() | Adds a new resource that should allow embedding the resource using , | ContentSecurityPolicy |
| addImageSrc() | Adds a new valid endpoint for valid image sources. Can be either a URI class or a simple string. | ContentSecurityPolicy |
| addManifestSrc() | Adds a new valid endpoint for manifest sources. Can be either a URI class or simple string. | ContentSecurityPolicy |
| addMediaSrc() | Adds a new valid endpoint for valid video and audio. Can be either a URI class or a simple string. | ContentSecurityPolicy |
| addObjectSrc() | Adds a new valid endpoint for Flash and other plugin sources. Can be either a URI class or a simple string. | ContentSecurityPolicy |
| addPluginType() | Limits the types of plugins that can be used. Can be either a URI class or a simple string. | ContentSecurityPolicy |
| addSandbox() | specifies an HTML sandbox policy that the user agent applies to the protected resource. | ContentSecurityPolicy |
| addScriptSrc() | Adds a new valid endpoint for javascript file sources. Can be either a URI class or a simple string. | ContentSecurityPolicy |
| addStyleSrc() | Adds a new valid endpoint for CSS file sources. Can be either a URI class or a simple string. | ContentSecurityPolicy |
| finalize() | Compiles and sets the appropriate headers in the request. | ContentSecurityPolicy |
| reportOnly() | If TRUE, nothing will be restricted. Instead all violations will be reported to the reportURI for monitoring. This is useful when you are just starting to implement the policy, and will help determine what errors need to be addressed before you turn on all filtering. | ContentSecurityPolicy |
| setDefaultSrc() | Adds a new valid endpoint for a form's action. Can be either a URI class or a simple string. | ContentSecurityPolicy |
| setReportURI() | Specifies a URL where a browser will send reports when a content security policy is violated. Can be either a URI class or a simple string. | ContentSecurityPolicy |
| upgradeInsecureRequests() | Sets whether the user agents should rewrite URL schemes, changing HTTP to HTTPS. | ContentSecurityPolicy |
ContentSecurityPolicy constructor.
Stores our default values from the Config file.
| Parameter Name | Type | Description |
|---|---|---|
| $config | \Config\ContentSecurityPolicy |
Returns:
Adds a new base_uri value. Can be either a URI class or a simple string.
base_uri restricts the URLs that can appear in a page’s
| Parameter Name | Type | Description |
|---|---|---|
| $uri | string|array | |
| $explicitReporting | bool|null |
Returns: $this
Adds a new valid endpoint for a form's action. Can be either a URI class or a simple string.
child-src lists the URLs for workers and embedded frame contents. For example: child-src https://youtube.com would enable embedding videos from YouTube but not from other origins.
| Parameter Name | Type | Description |
|---|---|---|
| $uri | string|array | |
| $explicitReporting | bool|null |
Returns: $this
Adds a new valid endpoint for a form's action. Can be either a URI class or a simple string.
connect-src limits the origins to which you can connect (via XHR, WebSockets, and EventSource).
| Parameter Name | Type | Description |
|---|---|---|
| $uri | string|array | |
| $explicitReporting | bool|null |
Returns: $this
Adds a new valid endpoint for a form's action. Can be either a URI class or a simple string.
font-src specifies the origins that can serve web fonts.
| Parameter Name | Type | Description |
|---|---|---|
| $uri | string|array | |
| $explicitReporting | bool|null |
Returns: $this
Adds a new valid endpoint for a form's action. Can be either a URI class or a simple string.
| Parameter Name | Type | Description |
|---|---|---|
| $uri | string|array | |
| $explicitReporting | bool|null |
Returns: $this
Adds a new resource that should allow embedding the resource using ,
| Parameter Name | Type | Description |
|---|---|---|
| $uri | string|array | |
| $explicitReporting | bool|null |
Returns: $this
Adds a new valid endpoint for valid image sources. Can be either a URI class or a simple string.
| Parameter Name | Type | Description |
|---|---|---|
| $uri | string|array | |
| $explicitReporting | bool|null |
Returns: $this
Adds a new valid endpoint for manifest sources. Can be either a URI class or simple string.
| Parameter Name | Type | Description |
|---|---|---|
| $uri | string|array | |
| $explicitReporting | bool|null |
Returns: $this
Adds a new valid endpoint for valid video and audio. Can be either a URI class or a simple string.
| Parameter Name | Type | Description |
|---|---|---|
| $uri | string|array | |
| $explicitReporting | bool|null |
Returns: $this
Adds a new valid endpoint for Flash and other plugin sources. Can be either a URI class or a simple string.
| Parameter Name | Type | Description |
|---|---|---|
| $uri | string|array | |
| $explicitReporting | bool|null |
Returns: $this
Limits the types of plugins that can be used. Can be either a URI class or a simple string.
| Parameter Name | Type | Description |
|---|---|---|
| $mime | string|array | One |
| $explicitReporting | bool|null |
Returns: $this
specifies an HTML sandbox policy that the user agent applies to the protected resource.
| Parameter Name | Type | Description |
|---|---|---|
| $flags | string|array | An |
| $explicitReporting | bool|null |
Returns: $this
Adds a new valid endpoint for javascript file sources. Can be either a URI class or a simple string.
| Parameter Name | Type | Description |
|---|---|---|
| $uri | string|array | |
| $explicitReporting | bool|null |
Returns: $this
Adds a new valid endpoint for CSS file sources. Can be either a URI class or a simple string.
| Parameter Name | Type | Description |
|---|---|---|
| $uri | string|array | |
| $explicitReporting | bool|null |
Returns: $this
Compiles and sets the appropriate headers in the request.
Should be called just prior to sending the response to the user agent.
| Parameter Name | Type | Description |
|---|---|---|
| $response | \ResponseInterface |
Returns:
If TRUE, nothing will be restricted. Instead all violations will be reported to the reportURI for monitoring. This is useful when you are just starting to implement the policy, and will help determine what errors need to be addressed before you turn on all filtering.
| Parameter Name | Type | Description |
|---|---|---|
| $value | bool |
Returns: $this
Adds a new valid endpoint for a form's action. Can be either a URI class or a simple string.
default_src is the URI that is used for many of the settings when no other source has been set.
| Parameter Name | Type | Description |
|---|---|---|
| $uri | string|array | |
| $explicitReporting | bool|null |
Returns: $this
Specifies a URL where a browser will send reports when a content security policy is violated. Can be either a URI class or a simple string.
| Parameter Name | Type | Description |
|---|---|---|
| $uri | string |
Returns: $this
Sets whether the user agents should rewrite URL schemes, changing HTTP to HTTPS.
| Parameter Name | Type | Description |
|---|---|---|
| $value | bool |
Returns: $this