aidantwoods / aidantwoods/SecureHeaders

Add hashes and nonces as friendly directive

未关闭
#70 2 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看
feature request
主要语言
PHP
星标
433
派生
21
PR 合并指标
30 天内没有已合并 PR

描述

I know that the package is meant to not use them directly, but sometimes it could be useful to be able to insert nonces and hashes directly instead of relying on the given API methods.
It's actually already doable via `csp()` method, but with a somehow hacky notation:

'\'sha256-K28TraF0hDSDYoxDYfyCCb5cCVAhDUyT0P1E3a+hKyQ=\''
"'sha256-K28TraF0hDSDYoxDYfyCCb5cCVAhDUyT0P1E3a+hKyQ='"
'\'nonce-xxxxxxxx\''
"'nonce-xxxxxxxx'"

I've not tested those on your library directly but I use them in laravel-securityheaders and they work.

My request, if possible, is to add two more "friendly directive":
- one for nonces, which checks if the string start with a "nonce-" and automatically adds the single quotation marks, while preserving the actual nonce value
- and one for hashes, which checks if the string starts with a "sha[acceptableVersionOfSHA]-" and automatically adds the single quotation marks, while preserving the actual encoded hash value.

贡献指南

打开贡献指南

评估

这个 Issue 还没有评估数据。

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。