SilverStripe security headers

, _(*1)

SilverStripe module for easily adding a selection of useful HTTP headers., _(*2)

Comes with a default set of headers configured, but can be used to add any headers you wish., _(*3)

Install

Install via composer:, _(*4)

composer require guttmann/silverstripe-security-headers 1.0.*

Usage

Apply the extension

Apply the SecurityHeaderControllerExtension to the controller of your choice., _(*5)

For example, add this to your mysite/_config/config.yml file:, _(*6)

Page_Controller:
  extensions:
    - Guttmann\SilverStripe\SecurityHeaderControllerExtension

Configure the headers

Configure header values to suit your site, it's important your config is loaded after the security-headers module's config., _(*7)

For example, your mysite/_config/config.yml file might look like this:, _(*8)

---
Name: mysite
After:
  - 'framework/*'
  - 'cms/*'
  - 'security-headers/*'
---
Guttmann\SilverStripe\SecurityHeaderControllerExtension:
  headers:
    Content-Security-Policy: "default-src 'self' *.google-analytics.com;"
    Strict-Transport-Security: "max-age=2592000"