Laravel CSP

https://github.com/spatie/laravel-csp
Admin
Laravel CSP is a Laravel package that makes it easy to add Content Security Policy headers to your...
Tokens:61,339
Snippets:391
Trust Score:10
License:MIT
Update:1 month ago
Show doc for...
Tokens:
Raw
### Using RandomString directly

Source: https://github.com/spatie/laravel-csp/blob/main/_autodocs/api-reference/nonce.md

Shows how to instantiate RandomString and call generate() to get a nonce. The example output is a sample 32-character string.

```php
use Spatie\Csp\Nonce\RandomString;

$generator = new RandomString;

$nonce = $generator->generate(); // e.g. "eL0oEwR9gBQjrW6kMvzXa4cOpN2sY7u"
```

--------------------------------

### Install laravel-csp via Composer

Source: https://github.com/spatie/laravel-csp/blob/main/README.md

Install the package via Composer.

```bash
composer require spatie/laravel-csp
```

--------------------------------

### Policy::create (static)

Source: https://github.com/spatie/laravel-csp/blob/main/_autodocs/api-reference/policy.md

Documentation for the static `Policy::create` method, including parameters, return type, exceptions, and usage examples.

```APIDOC
## `create` (static)

### Description
Creates a new CSP policy by applying a list of presets and additional directives. It resolves each preset class from the container, verifies it implements the `Preset` interface, and configures the policy accordingly.

### Method
`Policy::create` (static method)

### Signature
```php
public static function create(
    array $presets = [],
    array $directives = [],
    ?string $reportUri = null,
    ?string $reportTo = null,
): self
```

### Parameters

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| `presets` | `array` (of `class-string<Preset>`) | no | `[]` | Preset class names. The `$directives` parameter type is declared as `array`; the docblock annotates it as `class-string<Preset>[]`. |
| `directives` | `array` (of `[Directive, Keyword\|string\|array\|bool]` tuples) | no | `[]` | Extra directive/value tuples applied after all presets. |
| `reportUri` | `?string` | no | `null` | Passed to the constructor. |
| `reportTo` | `?string` | no | `null` | Passed to the constructor. |

### Returns
`self` (a `Policy` instance) with all presets configured and all extra directives applied.

### Throws

| Error | Condition |
|-------|-----------|
| `InvalidPreset` | A resolved `$presets` entry is not a `Preset` instance (`src/Policy.php:170-173`). |
| `InvalidDirective` | A `$directives` tuple whose directive is not a `Directive` (delegated to `add()`). |
| `InvalidValueSet` | A `$directives` tuple combining `Keyword::NONE` with other values (delegated to `add()`). |

### Example — basic use

```php
use Spatie\Csp\Directive;
use Spatie\Csp\Keyword;
use Spatie\Csp\Policy;
use Spatie\Csp\Presets\Basic;

$policy = Policy::create(
    presets: [Basic::class, App\Support\MyPreset::class],
    directives: [
        [Directive::SCRIPT, [Keyword::UNSAFE_EVAL]],
    ],
    reportUri: 'https://example.com/csp-reports',
    reportTo: 'default',
);

response->headers->set('Content-Security-Policy', $policy->getContents());
```

### Example — custom preset that does not implement the interface

```php
use Spatie\Csp\Exceptions\InvalidPreset;
use Spatie\Csp\Policy;

try {
    Policy::create([SomeNonPresetClass::class]);
} catch (InvalidPreset $e) {
    // "The CSP class `SomeNonPresetClass` is not valid. A valid policy implements Spatie\Csp\Preset"
}
```
```

--------------------------------

### Stacking multiple presets in configuration

Source: https://github.com/spatie/laravel-csp/blob/main/_autodocs/api-reference/presets.md

Configuration example showing how to stack multiple presets. Each preset adds its own directives, and values for the same directive accumulate with union semantics.

```php
'presets' => [
    Spatie\Csp\Presets\Basic::class,
    App\Support\MyCspPreset::class,
],

```

--------------------------------

### Example HTML output of __toString

Source: https://github.com/spatie/laravel-csp/blob/main/_autodocs/api-reference/csp-meta-tag.md

Example output of __toString() when both policies are non-empty. Shows two meta tags on separate lines.

```html
<meta http-equiv="Content-Security-Policy" content="default-src 'self';script-src 'self' 'nonce-…'">
<meta http-equiv="Content-Security-Policy-Report-Only" content="default-src 'self'">
```

--------------------------------

### Configuration and output for reporting_endpoints

Source: https://github.com/spatie/laravel-csp/blob/main/_autodocs/api-reference/add-csp-headers.md

Configuration example for reporting_endpoints and the resulting Reporting-Endpoints header output.

```php
// config/csp.php
'reporting_endpoints' => [
    'default' => 'https://example.com/csp-reports',
],
```

```text
Reporting-Endpoints: default="https://example.com/csp-reports"
```

--------------------------------

### Basic usage of Policy::create()

Source: https://github.com/spatie/laravel-csp/blob/main/_autodocs/api-reference/policy.md

Basic usage example: creates a policy with the Basic preset and a custom preset, adds an extra directive for script-src allowing unsafe-eval, sets report URI and report-to, then applies the policy to the response header.

```php
use Spatie\Csp\Directive;
use Spatie\Csp\Keyword;
use Spatie\Csp\Policy;
use Spatie\Csp\Presets\Basic;

$policy = Policy::create(
    presets: [Basic::class, App\Support\MyPreset::class],
    directives: [
        [Directive::SCRIPT, [Keyword::UNSAFE_EVAL]],
    ],
    reportUri: 'https://example.com/csp-reports',
    reportTo: 'default',
);

response->headers->set('Content-Security-Policy', $policy->getContents());
```

--------------------------------

### Basic add usage in a preset with serialized output

Source: https://github.com/spatie/laravel-csp/blob/main/_autodocs/api-reference/policy.md

Example of using the add method inside a preset, showing how to add multiple directives and values. The serialized output is shown as it would be produced by getContents().

```php
use Spatie\Csp\Directive;
use Spatie\Csp\Keyword;
use Spatie\Csp\Policy;
use Spatie\Csp\Preset;

class MyPreset implements Preset
{
    public function configure(Policy $policy): void
    {
        $policy
            ->add(Directive::SCRIPT, Keyword::SELF)
            ->add([Directive::IMG, Directive::CONNECT], ['https://static.example.com', 'data:'])
            ->add(Directive::STYLE, [Keyword::SELF, Keyword::UNSAFE_INLINE])
            ->add(Directive::UPGRADE_INSECURE_REQUESTS, Value::NO_VALUE); // valueless directive
    }
}
```

```text
script-src 'self';img-src https://static.example.com data:;connect-src https://static.example.com data:;style-src 'self' 'unsafe-inline';upgrade-insecure-requests
```

--------------------------------

### Example — isEmpty

Source: https://github.com/spatie/laravel-csp/blob/main/_autodocs/api-reference/policy.md

Example usage of `isEmpty()` to check if a policy has no directives. If empty, no headers should be emitted for the policy.

```php
use Spatie\Csp\Policy;

$policy = new Policy;

if ($policy->isEmpty()) {
    // No headers should be emitted for this policy
}
```

--------------------------------

### String interpolation example with CspMetaTag

Source: https://github.com/spatie/laravel-csp/blob/main/_autodocs/api-reference/csp-meta-tag.md

Example of string interpolation with __toString(). The meta tag renders automatically when interpolated. When config('csp.enabled') is false, create() returns an instance with empty policies and __toString() returns an empty string.

```php
use Spatie\Csp\CspMetaTag;

$metaTag = CspMetaTag::create();

$html = """
    <head>
        {$metaTag}
    </head>
    """;
```

--------------------------------

### Reporting configuration example

Source: https://github.com/spatie/laravel-csp/blob/main/_autodocs/configuration.md

Configures both report-uri (deprecated but widely supported) and report-to (modern) simultaneously; browsers pick whichever they support. The reporting_endpoints map defines named endpoints for report-to.

```php
'report_uri' => env('CSP_REPORT_URI', 'https://example.com/csp-reports'),
'report_to' => env('CSP_REPORT_TO', 'default'),

'reporting_endpoints' => [
    'default' => 'https://example.com/csp-reports',
],
```

--------------------------------

### Example usage of hasCspHeader

Source: https://github.com/spatie/laravel-csp/blob/main/_autodocs/api-reference/add-csp-headers.md

Example usage of hasCspHeader to check if another middleware already set CSP headers.

```php
use Spatie\Csp\AddCspHeaders;

$middleware = new AddCspHeaders;

if ($middleware->hasCspHeader($response)) {
    // Another middleware already set the CSP headers
}
```

--------------------------------

### Output of upgrade-insecure-requests directive

Source: https://github.com/spatie/laravel-csp/blob/main/README.md

Example output of the CSP header when using `Value::NO_VALUE` for the `upgrade-insecure-requests` directive.

```text
Content-Security-Policy: upgrade-insecure-requests
```

--------------------------------

### Example using addNonce in a preset

Source: https://github.com/spatie/laravel-csp/blob/main/_autodocs/api-reference/policy.md

Example preset that adds the 'self' keyword and a nonce to the script directive. With csp.nonce_enabled true and the default RandomString generator, it produces something like script-src 'self' 'nonce-eL0oEwR9gBQjrW6kMvzXa4cOpN2sY7u'.

```php
use Spatie\Csp\Directive;
use Spatie\Csp\Policy;
use Spatie\Csp\Preset;

class MyPreset implements Preset
{
    public function configure(Policy $policy): void
    {
        $policy
            ->add(Directive::SCRIPT, Keyword::SELF)
            ->addNonce(Directive::SCRIPT);
    }
}
```

--------------------------------

### Configure multiple CSP directives with multiple values

Source: https://github.com/spatie/laravel-csp/blob/main/README.md

Create multiple directive and value combinations by padding multiple values in the tuple. This example pairs the SCRIPT and STYLE directives with UNSAFE_EVAL and UNSAFE_INLINE keywords.

```php
'directives' => [
    [[Directive::SCRIPT, Directive::STYLE], [Keyword::UNSAFE_EVAL, Keyword::UNSAFE_INLINE]],
],
```

--------------------------------

### Catching InvalidPreset with non-preset class

Source: https://github.com/spatie/laravel-csp/blob/main/_autodocs/api-reference/policy.md

Example of catching InvalidPreset when passing a class that does not implement the Preset interface. The exception message is shown in the comment.

```php
use Spatie\Csp\Exceptions\InvalidPreset;
use Spatie\Csp\Policy;

try {
    Policy::create([SomeNonPresetClass::class]);
} catch (InvalidPreset $e) {
    // "The CSP class `SomeNonPresetClass` is not valid. A valid policy implements Spatie\Csp\Preset"
}
```

--------------------------------

### handle

Source: https://github.com/spatie/laravel-csp/blob/main/_autodocs/api-reference/add-csp-headers.md

Documentation for the `handle` method of the `AddCspHeaders` middleware, including parameters, return value, response headers, early-return conditions, and usage examples.

```APIDOC
## `handle`

### Description
Middleware handler that adds Content-Security-Policy headers to the response. It applies configured presets and directives, supports a custom preset override, and respects early-return conditions.

### Method
`handle`

### Endpoint
`Spatie\Csp\AddCspHeaders::handle(Request $request, Closure $next, ?string $customPreset = null)`

### Parameters
- `request` (Request) - Required - The incoming request (`Illuminate\Http\Request`). Currently unused by the middleware body itself.
- `next` (Closure) - Required - The next middleware in the chain; `$next($request)` produces the `Response`.
- `customPreset` (?string) - Optional - A preset class name supplied via `MiddlewareClass:PresetClass` route syntax. When set, only that preset is applied (no report-only policy, no `Reporting-Endpoints` header).

### Returns
The `Response` from `$next($request)`, possibly with CSP headers set.

### Response headers set
- `Content-Security-Policy` - When no `$customPreset` and the enforcing policy is non-empty, or `$customPreset` is set.
- `Content-Security-Policy-Report-Only` - When no `$customPreset` and the report-only policy is non-empty.
- `Reporting-Endpoints` - When no `$customPreset` and `csp.reporting_endpoints` is a non-empty array.

### Early-return conditions (response returned untouched)
1. `config('csp.enabled')` is falsy.
2. `config('app.debug')` is truthy **and** the response is a server error (`$response->isServerError()`).
3. `config('app.debug')` is truthy **and** `csp.enabled_while_hot_reloading` is falsy **and** `Vite::isRunningHot()` — i.e. Vite is hot-reloading and header emission during hot reloading is disabled.
4. The response already carries a `Content-Security-Policy` or `Content-Security-Policy-Report-Only` header (checked via `hasCspHeader`) — this gives precedence to a CSP middleware registered later in the stack.

### Example — basic registration
```php
use Spatie\Csp\AddCspHeaders;

// apply globally
->withMiddleware(function (Middleware $middleware) {
    $middleware->append(AddCspHeaders::class);
})
```

### Example — preset override on a route
```php
use Spatie\Csp\AddCspHeaders;
use Spatie\Csp\Presets\Intercom;

Route::get('intercom-test', 'IntercomController')
    ->middleware(AddCspHeaders::class . ':' . Intercom::class);
```

For that single route the response gets `Content-Security-Policy` built only from the `Intercom` preset — the configured `presets`/`directives`, the report-only policy and `Reporting-Endpoints` are skipped because `$customPreset` short-circuits before they are read.
```

--------------------------------

### Example — both setters

Source: https://github.com/spatie/laravel-csp/blob/main/_autodocs/api-reference/policy.md

Example showing both `setReportUri` and `setReportTo` setters used together on a `Policy` instance. The `setReportTo` method sets the `report-to` endpoint name used during serialization.

```php
use Spatie\Csp\Policy;

$policy = new Policy;
$policy
    ->setReportUri('https://example.com/csp-reports')
    ->setReportTo('default');
```

--------------------------------

### Custom preset implementation

Source: https://github.com/spatie/laravel-csp/blob/main/_autodocs/api-reference/presets.md

Shows how to create a custom preset by implementing the Preset interface. The configure method adds directives and values to the policy, including a nonce for scripts and an upgrade-insecure-requests directive.

```php
namespace App\Support;

use Spatie\Csp\Directive;
use Spatie\Csp\Keyword;
use Spatie\Csp\Policy;
use Spatie\Csp\Preset;

class MyCspPreset implements Preset
{
    public function configure(Policy $policy): void
    {
        $policy
            ->add(Directive::SCRIPT, [Keyword::SELF, 'www.google.com'])
            ->add(Directive::STYLE, Keyword::SELF)
            ->addNonce(Directive::SCRIPT)
            ->add(Directive::UPGRADE_INSECURE_REQUESTS, Value::NO_VALUE);
    }
}

```

--------------------------------

### Plain preset configure method

Source: https://github.com/spatie/laravel-csp/blob/main/_autodocs/api-reference/presets-embeds-and-cdns.md

Adds Plain chat hosts to SCRIPT, CONNECT, STYLE, and IMG directives.

```php
public function configure(Policy $policy): void
{
    $policy
        ->add(Directive::SCRIPT, 'https://chat.cdn-plain.com')
        ->add(Directive::CONNECT, [
            'https://chat.uk.plain.com',
            'https://prod-uk-services-attachm-attachmentsuploadbucket2-1l2e4906o2asm.s3.eu-west-2.amazonaws.com',
        ])
        ->add(Directive::STYLE, 'https://fonts.googleapis.com')
        ->add(Directive::IMG, [
            'https://prod-uk-services-workspac-workspacefilespublicbuck-vs4gjqpqjkh6.s3.amazonaws.com',
            'https://prod-uk-services-attachm-attachmentsbucket28b3ccf-uwfssb4vt2us.s3.eu-west-2.amazonaws.com',
            'https://i0.wp.com',
        ]);
}
```

--------------------------------

### Basic preset configure method

Source: https://github.com/spatie/laravel-csp/blob/main/_autodocs/api-reference/presets-embeds-and-cdns.md

The default preset, sets same-origin directives and nonces for scripts and styles. object-src is set to 'none'.

```php
public function configure(Policy $policy): void
{
    $policy
        ->add(Directive::BASE, Keyword::SELF)
        ->add(Directive::CONNECT, Keyword::SELF)
        ->add(Directive::DEFAULT, Keyword::SELF)
        ->add(Directive::FONT, Keyword::SELF)
        ->add(Directive::FORM_ACTION, Keyword::SELF)
        ->add(Directive::FRAME, Keyword::SELF)
        ->add(Directive::IMG, Keyword::SELF)
        ->add(Directive::MEDIA, Keyword::SELF)
        ->add(Directive::OBJECT, Keyword::NONE)
        ->add(Directive::SCRIPT, Keyword::SELF)
        ->add(Directive::STYLE, Keyword::SELF)
        ->addNonce(Directive::SCRIPT)
        ->addNonce(Directive::STYLE);
}
```

--------------------------------

### Basic::configure(Policy $policy): void

Source: https://github.com/spatie/laravel-csp/blob/main/_autodocs/api-reference/presets-embeds-and-cdns.md

The default preset that allows same-origin resources plus nonces for inline scripts and styles, and sets object-src to 'none'.

```APIDOC
## Basic::configure(Policy $policy): void

### Description
Configures the policy to allow same-origin resources for most directives, add nonces for scripts and styles, and set object-src to 'none'.

### Method
configure

### Parameters
- **$policy** (Policy) - Required - The policy instance to configure.

### Behavior
Adds the following directives:
- base-uri 'self'
- connect-src 'self'
- default-src 'self'
- font-src 'self'
- form-action 'self'
- frame-src 'self'
- img-src 'self'
- media-src 'self'
- object-src 'none'
- script-src 'self'
- style-src 'self'

Adds nonces for script-src and style-src.
```

--------------------------------

### configurePackage method

Source: https://github.com/spatie/laravel-csp/blob/main/_autodocs/api-reference/csp-service-provider.md

Configures the package name and declares that it ships a config file. Users publish the config with `php artisan vendor:publish --tag=csp-config`.

```php
public function configurePackage(Package $package): void
```

```php
$package
    ->name('laravel-csp')
    ->hasConfigFile();
```

--------------------------------

### GoogleMaps preset configure method

Source: https://github.com/spatie/laravel-csp/blob/main/_autodocs/api-reference/presets-embeds-and-cdns.md

Adds multiple Google domains and schemes to script-src, img-src, frame-src, connect-src, font-src, style-src, and worker-src directives.

```php
public function configure(Policy $policy): void
{
    $policy->add(Directive::SCRIPT, [
        'https://*.googleapis.com',
        'https://*.gstatic.com',
        '*.google.com',
        'https://*.ggpht.com',
        '*.googleusercontent.com',
        'blob:',
    ]);
    $policy->add(Directive::IMG, [
        'https://*.googleapis.com',
        'https://*.gstatic.com',
        '*.google.com',
        '*.googleusercontent.com',
        'data:',
    ]);
    $policy->add(Directive::FRAME, '*.google.com');
    $policy->add(Directive::CONNECT, [
        'https://*.googleapis.com',
        '*.google.com',
        'https://*.gstatic.com',
        'data:',
        'blob:',
    ]);
    $policy->add(Directive::FONT, 'https://fonts.gstatic.com');
    $policy->add(Directive::STYLE, 'https://fonts.googleapis.com');
    $policy->add(Directive::WORKER, 'blob:');
}
```

--------------------------------

### Maze preset configure method

Source: https://github.com/spatie/laravel-csp/blob/main/_autodocs/api-reference/presets-embeds-and-cdns.md

Adds Maze snippet and prompt hosts to SCRIPT and CONNECT directives.

```php
public function configure(Policy $policy): void
{
    $policy
        ->add(Directive::SCRIPT, [
            'https://snippet.maze.co',
        ])
        ->add(Directive::CONNECT, [
            'https://prompts.maze.co',
        ]);
}
```

--------------------------------

### Clarity preset configure method

Source: https://github.com/spatie/laravel-csp/blob/main/_autodocs/api-reference/presets-analytics.md

Configures a CSP policy to allow Microsoft Clarity analytics by adding the domains clarity.ms and c.bing.com for connect-src, script-src, and img-src directives.

```php
public function configure(Policy $policy): void
{
    $policy
        ->add([Directive::CONNECT, Directive::SCRIPT, Directive::IMG], 'https://*.clarity.ms')
        ->add([Directive::CONNECT, Directive::SCRIPT, Directive::IMG], 'https://c.bing.com');
}
```

--------------------------------

### Algolia preset: configure method

Source: https://github.com/spatie/laravel-csp/blob/main/_autodocs/api-reference/presets-embeds-and-cdns.md

Adds the CONNECT directive with multiple Algolia domains to allow network requests.

```php
public function configure(Policy $policy): void
{
    $policy
        ->add(Directive::CONNECT, [
            'https://*.algolia.net',
            'https://*.algolianet.com',
            'https://*.algolia.io',
        ]);
}
```

--------------------------------

### HeapAnalytics preset configure method

Source: https://github.com/spatie/laravel-csp/blob/main/_autodocs/api-reference/presets-analytics.md

Configures a CSP policy for Heap Analytics, allowing scripts from cdn.heapanalytics.com and images/connections from heapanalytics.com.

```php
public function configure(Policy $policy): void
{
    $policy
        ->add(Directive::SCRIPT, [
            'https://cdn.heapanalytics.com',
        ])
        ->add([Directive::IMG, Directive::CONNECT], [
            'https://heapanalytics.com',
        ]);
}
```

--------------------------------

### GoogleAds preset configure method

Source: https://github.com/spatie/laravel-csp/blob/main/_autodocs/api-reference/presets-analytics.md

Configures a CSP policy for Google Ads/AdSense endpoints, adding multiple domains for connect-src, img-src, script-src, and frame-src, and adds a nonce for script-src.

```php
public function configure(Policy $policy): void
{
    $policy
        ->add([Directive::CONNECT, Directive::IMG, Directive::SCRIPT], [
            'www.googleadservices.com',
            'pagead2.googlesyndication.com',
            'googleads.g.doubleclick.net',
            'www.google.com',
        ])
        ->add([Directive::IMG, Directive::SCRIPT], 'www.googletagmanager.com')
        ->add([Directive::CONNECT, Directive::IMG], 'google.com')
        ->add([Directive::CONNECT], 'ad.doubleclick.net')
        ->add([Directive::FRAME], 'www.googletagmanager.com')
        ->addNonce(Directive::SCRIPT);
}
```

--------------------------------

### Hireroad preset configure method

Source: https://github.com/spatie/laravel-csp/blob/main/_autodocs/api-reference/presets-embeds-and-cdns.md

Allows hireroad.com and vacancy-filler.co.uk domains for SCRIPT, FONT, and STYLE directives, and data: for FONT. Includes a comment about vacancy filler directives for old hireroad branded sites.

```php
// Vacancy filler directives for old hireroad branded sites since they have been migrated to hireroad
public function configure(Policy $policy): void
{
    $policy
        ->add([Directive::SCRIPT, Directive::FONT, Directive::STYLE], '*.hireroad.com')
        ->add([Directive::SCRIPT, Directive::FONT, Directive::STYLE], '*.vacancy-filler.co.uk')
        ->add(Directive::FONT, 'data:');
}
```

--------------------------------

### Bootstrap preset: configure method

Source: https://github.com/spatie/laravel-csp/blob/main/_autodocs/api-reference/presets-embeds-and-cdns.md

Adds STYLE and FONT directives for Bootstrap CDN and IMG for data scheme, with a comment about checkboxes/radios.

```php
public function configure(Policy $policy): void
{
    $policy
        ->add([Directive::STYLE, Directive::FONT], [
            'data:',
            'https://maxcdn.bootstrapcdn.com',
        ])
        ->add(Directive::IMG, Scheme::DATA); // For checkboxes/radios.
}
```

--------------------------------

### Fathom preset configure method

Source: https://github.com/spatie/laravel-csp/blob/main/_autodocs/api-reference/presets-analytics.md

Configures a CSP policy to allow Fathom analytics by adding cdn.usefathom.com for img-src, script-src, and connect-src directives.

```php
public function configure(Policy $policy): void
{
    $policy
        ->add([Directive::IMG, Directive::SCRIPT, Directive::CONNECT], 'cdn.usefathom.com');
}
```

--------------------------------

### Chargebee preset: configure method

Source: https://github.com/spatie/laravel-csp/blob/main/_autodocs/api-reference/presets-embeds-and-cdns.md

Adds FRAME, SCRIPT, SCRIPT_ELEM, and STYLE_ELEM directives for 'js.chargebee.com' to allow embedding and scripting.

```php
public function configure(Policy $policy): void
{
    $policy
        ->add(
            [Directive::FRAME, Directive::SCRIPT, Directive::SCRIPT_ELEM, Directive::STYLE_ELEM],
            ['js.chargebee.com']
        );
}
```

--------------------------------

### GoogleLookerStudio preset configure method

Source: https://github.com/spatie/laravel-csp/blob/main/_autodocs/api-reference/presets-analytics.md

Configures the CSP policy for Google Looker Studio, allowing frames from lookerstudio.google.com.

```php
public function configure(Policy $policy): void
{
    $policy
        ->add(Directive::FRAME, [
            'https://lookerstudio.google.com',
        ]);
}
```

--------------------------------

### packageBooted method

Source: https://github.com/spatie/laravel-csp/blob/main/_autodocs/api-reference/csp-service-provider.md

Registers request-scoped container bindings for the nonce generator and the `csp-nonce` string key when nonces are enabled. Also registers Blade directives after the view binding resolves.

```php
public function packageBooted()
```

```php
if (config('csp.nonce_enabled', true)) {
    $this->app->scoped(NonceGenerator::class, config('csp.nonce_generator'));

    $this->app->scoped('csp-nonce', function () {
        return app(NonceGenerator::class)->generate();
    });
}

$this->callAfterResolving('view', function () {
    $this->registerBladeDirectives();
});
```

--------------------------------

### Sentry preset configure method

Source: https://github.com/spatie/laravel-csp/blob/main/_autodocs/api-reference/presets-embeds-and-cdns.md

Adds Sentry ingest hosts to CONNECT and allows worker/child sources for Session Replay. Includes comments explaining the need for both worker-src and child-src.

```php
// @see: https://docs.sentry.io/platforms/javascript/session-replay/
// Session Replay compresses payloads in a worker created from a blob URL. `child-src` covers
// Safari 15.4 and older, which predate `worker-src`. Both list `'self'` because neither
// directive falls back to `default-src` once it is present.
public function configure(Policy $policy): void
{
    $policy
        ->add(Directive::CONNECT, [
            'https://*.ingest.de.sentry.io',
            'https://*.ingest.us.sentry.io',
        ])
        ->add([Directive::WORKER, Directive::CHILD], [
            Keyword::SELF,
            Scheme::BLOB,
        ]);
}
```

--------------------------------

### Posthog preset configure method

Source: https://github.com/spatie/laravel-csp/blob/main/_autodocs/api-reference/presets-analytics.md

Configures a CSP policy for PostHog, allowing scripts from *.posthog.com, script elements from EU/US asset hosts, and connections to EU/US API hosts.

```php
public function configure(Policy $policy): void
{
    $policy
        ->add(Directive::SCRIPT, '*.posthog.com')
        ->add([Directive::SCRIPT, Directive::SCRIPT_ELEM], ['eu-assets.i.posthog.com', 'us-assets.i.posthog.com'])
        ->add(Directive::CONNECT, ['eu.i.posthog.com', 'us.i.posthog.com']);
}
```

--------------------------------

### JsDelivr preset configure method

Source: https://github.com/spatie/laravel-csp/blob/main/_autodocs/api-reference/presets-embeds-and-cdns.md

Adds the jsDelivr CDN host to multiple directives (SCRIPT, STYLE, FONT, CONNECT).

```php
public function configure(Policy $policy): void
{
    $policy
        ->add([Directive::SCRIPT, Directive::STYLE, Directive::FONT, Directive::CONNECT], 'cdn.jsdelivr.net');
}
```

--------------------------------

### GoogleFonts preset configure method

Source: https://github.com/spatie/laravel-csp/blob/main/_autodocs/api-reference/presets-embeds-and-cdns.md

Adds fonts.googleapis.com to style-src and fonts.gstatic.com to font-src.

```php
public function configure(Policy $policy): void
{
    $policy
        ->add(Directive::STYLE, 'fonts.googleapis.com')
        ->add(Directive::FONT, 'fonts.gstatic.com');
}
```

--------------------------------

### HubSpot preset configure method

Source: https://github.com/spatie/laravel-csp/blob/main/_autodocs/api-reference/presets-embeds-and-cdns.md

Comprehensive configuration for HubSpot full suite (tracking, forms, video, feedback, attachments). Adds many HubSpot domains for various directives.

```php
public function configure(Policy $policy): void
{
    $policy
        ->add(Directive::SCRIPT, '*.hsadspixel.net')
        ->add(Directive::SCRIPT, '*.hs-analytics.net')
        ->add(Directive::CONNECT, '*.hubapi.com')
        ->add([Directive::SCRIPT, Directive::IMG, Directive::CONNECT], [
            'js.hscta.net',
            'js-eu1.hscta.net',
        ])
        ->add(Directive::IMG, 'no-cache.hubspot.com')
        ->add([Directive::SCRIPT, Directive::IMG, Directive::CONNECT, Directive::FRAME], '*.hubspot.com')
        ->add(Directive::FRAME, [
            '*.hs-sites.com',
            '*.hs-sites-eu1.com',
        ])
        ->add(Directive::SCRIPT, 'static.hsappstatic.net')
        ->add(Directive::SCRIPT, '*.usemessages.com')
        ->add([Directive::SCRIPT, Directive::CONNECT], '*.hs-banner.com')
        ->add([Directive::SCRIPT, Directive::IMG, Directive::STYLE], [
            '*.hubspotusercontent00.net',
            '*.hubspotusercontent10.net',
            '*.hubspotusercontent20.net',
            '*.hubspotusercontent30.net',
            '*.hubspotusercontent40.net',
        ])
        ->add([Directive::SCRIPT, Directive::IMG, Directive::FRAME], '*.hubspot.net')
        ->add(Directive::FRAME, [
            'play.hubspotvideo.com',
            'play-eu1.hubspotvideo.com',
        ])
        ->add([Directive::IMG, Directive::STYLE], 'cdn2.hubspot.net')
        ->add([Directive::SCRIPT, Directive::CONNECT], '*.hscollectedforms.net')
        ->add(Directive::SCRIPT, '*.hsleadflows.net')
        ->add([Directive::SCRIPT, Directive::IMG, Directive::FRAME], '*.hsforms.net')
        ->add([Directive::SCRIPT, Directive::IMG, Directive::FRAME, Directive::CONNECT, Directive::CHILD], '*.hsforms.com')
        ->add(Directive::SCRIPT, '*.hs-scripts.com')
        ->add(Directive::SCRIPT, '*.hubspotfeedback.com')
        ->add(Directive::SCRIPT, 'feedback.hubapi.com')
        ->add(Directive::SCRIPT, 'feedback-eu1.hubapi.com');
}
```

--------------------------------

### VisualWebsiteOptimizer preset configure method

Source: https://github.com/spatie/laravel-csp/blob/main/_autodocs/api-reference/presets-analytics.md

Configures the CSP policy for Visual Website Optimizer (VWO), allowing blob: and dev.visualwebsiteoptimizer.com for scripts, images, and connections.

```php
public function configure(Policy $policy): void
{
    $policy
        ->add([Directive::SCRIPT, Directive::IMG, Directive::CONNECT], [
            'blob:',
            'https://dev.visualwebsiteoptimizer.com',
        ]);
}
```

--------------------------------

### Register custom preset in config

Source: https://github.com/spatie/laravel-csp/blob/main/README.md

Configuration snippet showing how to register custom presets in the `csp` config file.

```php
'presets' => [
    Spatie\Csp\Presets\Basic::class,
    App\Support\MyCspPreset::class,
],
```

--------------------------------

### HotJar preset configure method

Source: https://github.com/spatie/laravel-csp/blob/main/_autodocs/api-reference/presets-analytics.md

Configures a CSP policy for HotJar, allowing frames, scripts, fonts, styles, and images from *.hotjar.com, and connections to various hotjar domains.

```php
// @see: https://help.hotjar.com/hc/en-us/articles/115011640307-Content-Security-Policies
public function configure(Policy $policy): void
{
    $policy
        ->add([Directive::FRAME, Directive::SCRIPT, Directive::FONT, Directive::STYLE, Directive::IMG], '*.hotjar.com')
        ->add(Directive::CONNECT, ['https://*.hotjar.com', 'https://*.hotjar.io', 'wss://*.hotjar.com']);
}
```

--------------------------------

### BunnyFonts preset: configure method

Source: https://github.com/spatie/laravel-csp/blob/main/_autodocs/api-reference/presets-embeds-and-cdns.md

Adds STYLE and FONT directives for 'fonts.bunny.net' to allow loading fonts and styles.

```php
public function configure(Policy $policy): void
{
    $policy
        ->add(Directive::STYLE, 'fonts.bunny.net')
        ->add(Directive::FONT, 'fonts.bunny.net');
}
```

--------------------------------

### CloudflareWebAnalytics preset configure method

Source: https://github.com/spatie/laravel-csp/blob/main/_autodocs/api-reference/presets-analytics.md

Configures a CSP policy to allow Cloudflare Web Analytics by adding cloudflareinsights.com for connect-src and static.cloudflareinsights.com for script-src.

```php
public function configure(Policy $policy): void
{
    $policy
        ->add(Directive::CONNECT, 'cloudflareinsights.com')
        ->add(Directive::SCRIPT, 'static.cloudflareinsights.com');
}
```

--------------------------------

### ThereThere preset configure method

Source: https://github.com/spatie/laravel-csp/blob/main/_autodocs/api-reference/presets-embeds-and-cdns.md

Configures the CSP policy for the There There support bubble widget, allowing scripts from files.there-there.app, frames from there-there.app, WebSocket connections, and inline styles.

```php
// Allows embedding the There There support bubble widget (https://there-there.app).
// The loader script is served from files.there-there.app and injects an iframe,
// its API/WebSocket traffic, and a small <style> block for the launcher animations.
public function configure(Policy $policy): void
{
    $policy
        ->add(Directive::SCRIPT, 'https://files.there-there.app')
        ->add(Directive::FRAME, 'https://there-there.app')
        ->add(Directive::CONNECT, [
            'https://there-there.app',
            'wss://there-there.app',
        ])
        ->add(Directive::STYLE, Keyword::UNSAFE_INLINE);
}
```

--------------------------------

### Handling InvalidPreset exception

Source: https://github.com/spatie/laravel-csp/blob/main/_autodocs/api-reference/presets.md

Demonstrates error handling when a non-preset class is passed to Policy::create(). The InvalidPreset exception is thrown with a message indicating the class is not a valid preset.

```php
use Spatie\Csp\Exceptions\InvalidPreset;
use Spatie\Csp\Policy;

try {
    Policy::create([SomeClassThatIsNotAPreset::class]);
} catch (InvalidPreset $e) {
    // Message: "The CSP class `SomeClassThatIsNotAPreset` is not valid. A valid policy implements Spatie\Csp\Preset"
}

```

--------------------------------

### __toString

Source: https://github.com/spatie/laravel-csp/blob/main/_autodocs/api-reference/csp-meta-tag.md

Builds one meta tag per non-empty policy, joined with PHP_EOL. Returns an empty string when both policies are empty (e.g., CSP disabled).

```APIDOC
## `__toString`

### Description
Builds one meta tag per non-empty policy, joined with `PHP_EOL`. Returns an empty string when both policies are empty (e.g., CSP disabled).

### Method
`public function __toString(): string`

### Returns
`string` — `""` when both policies are empty, otherwise one or two meta tags on separate lines:

```html
<meta http-equiv="Content-Security-Policy" content="default-src 'self';script-src 'self' 'nonce-…'">
<meta http-equiv="Content-Security-Policy-Report-Only" content="default-src 'self'">
```

### Example — string interpolation
```php
use Spatie\Csp\CspMetaTag;

$metaTag = CspMetaTag::create();

$html = """
    <head>
        {$metaTag}
    </head>
    """;
```

Because `__toString()` is defined, the tag renders automatically when interpolated or echoed. When `config('csp.enabled') === false`, `create()` returns an instance with empty policies and `__toString()` returns `""`.
```

--------------------------------

### Vimeo preset configure method

Source: https://github.com/spatie/laravel-csp/blob/main/_autodocs/api-reference/presets-embeds-and-cdns.md

Preset for Vimeo. Adds directives for SCRIPT and FRAME to player.vimeo.com, CONNECT to vimeo.com, and IMG to *.vimeocdn.com.

```php
public function configure(Policy $policy): void
{
    $policy
        ->add([Directive::SCRIPT, Directive::FRAME], 'player.vimeo.com')
        ->add(Directive::CONNECT, 'vimeo.com')
        ->add(Directive::IMG, '*.vimeocdn.com');
}
```

--------------------------------

### SurveyMonkey preset configure method

Source: https://github.com/spatie/laravel-csp/blob/main/_autodocs/api-reference/presets-embeds-and-cdns.md

Configures the CSP policy for SurveyMonkey, allowing frames from www.surveymonkey.com.

```php
public function configure(Policy $policy): void
{
    $policy
        ->add(Directive::FRAME, ['https://www.surveymonkey.com']);
}
```

--------------------------------

### JQuery preset configure method

Source: https://github.com/spatie/laravel-csp/blob/main/_autodocs/api-reference/presets-embeds-and-cdns.md

Adds the jQuery CDN host to the SCRIPT directive.

```php
public function configure(Policy $policy): void
{
    $policy
        ->add(Directive::SCRIPT, [
            'https://code.jquery.com',
        ]);
}
```

--------------------------------

### Tolt preset configure method

Source: https://github.com/spatie/laravel-csp/blob/main/_autodocs/api-reference/presets-analytics.md

Configures the CSP policy for Tolt by allowing scripts from cdn.tolt.io.

```php
public function configure(Policy $policy): void
{
    $policy
        ->add(Directive::SCRIPT, 'cdn.tolt.io');
}
```

--------------------------------

### CloudflareTurnstile preset configure method

Source: https://github.com/spatie/laravel-csp/blob/main/_autodocs/api-reference/presets-embeds-and-cdns.md

Adds the Cloudflare Turnstile challenge domain to the frame-src and script-src directives.

```php
public function configure(Policy $policy): void
{
    $policy
        ->add([Directive::FRAME, Directive::SCRIPT], 'https://challenges.cloudflare.com');
}
```

--------------------------------

### Run tests with composer test

Source: https://github.com/spatie/laravel-csp/blob/main/README.md

Command to run all tests for the package.

```bash
composer test
```

--------------------------------

### CloudflareCdn preset: configure method

Source: https://github.com/spatie/laravel-csp/blob/main/_autodocs/api-reference/presets-embeds-and-cdns.md

Adds STYLE, SCRIPT, and FONT directives for 'https://cdnjs.cloudflare.com' to allow loading resources from the CDN.

```php
public function configure(Policy $policy): void
{
    $policy
        ->add([Directive::STYLE, Directive::SCRIPT, Directive::FONT], [
            'https://cdnjs.cloudflare.com',
        ]);
}
```

--------------------------------

### PlausibleAnalytics preset configure method

Source: https://github.com/spatie/laravel-csp/blob/main/_autodocs/api-reference/presets-analytics.md

Configures a CSP policy for Plausible Analytics, allowing scripts and connections from plausible.io.

```php
public function configure(Policy $policy): void
{
    $policy
        ->add(Directive::SCRIPT, 'plausible.io')
        ->add(Directive::CONNECT, 'plausible.io');
}
```

--------------------------------

### Firebase preset configure method

Source: https://github.com/spatie/laravel-csp/blob/main/_autodocs/api-reference/presets-embeds-and-cdns.md

Adds Firebase and Google domains to script-src, connect-src, and worker-src directives, including the self keyword for workers.

```php
public function configure(Policy $policy): void
{
    $policy
        ->add(Directive::SCRIPT, [
            'https://www.gstatic.com',
            'https://www.googleapis.com',
        ])
        ->add(Directive::CONNECT, [
            'https://fcmregistrations.googleapis.com',
            'https://firebaseinstallations.googleapis.com',
            'https://firebase.googleapis.com',
            'https://fcm.googleapis.com',
            'https://www.googleapis.com',
        ])
        ->add(Directive::WORKER, [Keyword::SELF]);
}
```

--------------------------------

### CspMetaTag::create (static)

Source: https://github.com/spatie/laravel-csp/blob/main/_autodocs/api-reference/csp-meta-tag.md

Static factory to create a CspMetaTag instance from presets or configuration, with optional report-only mode.

```APIDOC
## CspMetaTag::create (static)

### Description
Creates a CspMetaTag instance. If `config('csp.enabled')` is falsy, returns an instance with empty policies. Otherwise, builds policies from provided presets or from configuration.

### Method
Static method

### Signature
```php
public static function create(string|array $presets = [], bool $reportOnly = false): static
```

### Parameters
- **presets** (string|array) - Optional - Default: `[]` - One preset class name or an array of them. Empty means use configured presets.
- **reportOnly** (bool) - Optional - Default: `false` - When `true`, the passed presets are configured into the report-only policy.

### Returns
`static` (a `CspMetaTag`). When `config('csp.enabled')` is falsy, an instance with empty policies.

### Throws
- **InvalidPreset** - When a preset class name does not implement `Preset`.
- **InvalidDirective** / **InvalidValueSet** - When a directive tuple is invalid.

### Example
```blade
<head>
    @cspMetaTag
</head>
```

Output (abridged):
```html
<meta http-equiv="Content-Security-Policy" content="base-uri 'self';connect-src 'self';...">
```
```

--------------------------------

### Policy::create() static factory method

Source: https://github.com/spatie/laravel-csp/blob/main/_autodocs/api-reference/policy.md

Static factory method that resolves each preset class from the container, validates it implements Preset (throwing InvalidPreset otherwise), configures the policy, then applies extra directive tuples. Preset order is preserved and values for the same directive union.

```php
/** @param class-string<Preset>[] $presets */
public static function create(
    array $presets = [],
    array $directives = [],
    ?string $reportUri = null,
    ?string $reportTo = null,
): self {
    $policy = array_reduce($presets, function (Policy $policy, string $className) {
        $preset = app($className);

        if (! is_a($preset, Preset::class, true)) {
            throw InvalidPreset::create($preset);
        }

        $preset->configure($policy);

        return $policy;
    }, new static($reportUri, $reportTo));

    foreach ($directives as [$directive, $contents]) {
        $policy->add($directive, $contents);
    }

    return $policy;
}
```

--------------------------------

### TrackJs preset configure method

Source: https://github.com/spatie/laravel-csp/blob/main/_autodocs/api-reference/presets-analytics.md

Configures the CSP policy for TrackJs, allowing connections to capture.trackjs.com, images from usage.trackjs.com, scripts from cdn.trackjs.com, and script elements from cdn.trackjs.com and js.trackjs.com.

```php
public function configure(Policy $policy): void
{
    $policy
        ->add(Directive::CONNECT, [
            'capture.trackjs.com',
        ])
        ->add(Directive::IMG, [
            'usage.trackjs.com',
        ])
        ->add(Directive::SCRIPT, [
            'cdn.trackjs.com',
        ])
        ->add(Directive::SCRIPT_ELEM, [
            'cdn.trackjs.com',
            'js.trackjs.com',
            'cdn.trackjs.com',
        ]);
}
```

--------------------------------

### getContents method signature

Source: https://github.com/spatie/laravel-csp/blob/main/_autodocs/api-reference/policy.md

Serializes the policy to the CSP header value. Appends `report-uri` and `report-to` when set, then joins every directive with `;`.

```php
public function getContents(): string
```

--------------------------------

### Register AddCspHeaders with a preset override

Source: https://github.com/spatie/laravel-csp/blob/main/_autodocs/api-reference/add-csp-headers.md

Attaches the middleware to a route with a custom preset class. The ':MyPreset::class' suffix is passed to handle() as the $customPreset parameter.

```php
// route level, with a preset override
Route::get('my-page', 'MyController')
    ->middleware(AddCspHeaders::class . ':' . MyPreset::class);
```

--------------------------------

### Whereby preset configure method

Source: https://github.com/spatie/laravel-csp/blob/main/_autodocs/api-reference/presets-embeds-and-cdns.md

Preset for Whereby. Adds SCRIPT and FRAME directives for https://*.whereby.com.

```php
public function configure(Policy $policy): void
{
    $policy
        ->add([Directive::SCRIPT, Directive::FRAME], [
            'https://*.whereby.com',
        ]);
}
```

--------------------------------

### GoogleTlds preset configure and getDomains methods

Source: https://github.com/spatie/laravel-csp/blob/main/_autodocs/api-reference/presets-analytics.md

Configures the CSP policy for Google regional top-level domains, allowing connections and images from a list of Google domains. The full list is documented at src/Presets/GoogleTlds.php:17-209.

```php
public function configure(Policy $policy): void
{
    $policy
        ->add([Directive::CONNECT, Directive::IMG], $this->getDomains());
}

private function getDomains(): array
{
    return [
        'google.com',
        '*.google.com',
        '*.google.ad',
        '*.google.ae',
        '*.google.com.af',
        '*.google.com.ag',
        '*.google.al',
        '*.google.am',
        '*.google.co.ao',
        // ... ~180 regional TLDs, e.g. '*.google.co.uk', '*.google.com.au', '*.google.co.za'
    ];
}
```

--------------------------------

### Configure global CSP directives in config/csp.php

Source: https://github.com/spatie/laravel-csp/blob/main/README.md

Register global directives in the config/csp.php file using tuple notation. The 'directives' key applies the CSP, while 'report_only_directives' only reports violations without enforcing them.

```php
'directives' => [
    [Directive::SCRIPT, Keyword::UNSAFE_EVAL],
],

'report_only_directives' => [
    [Directive::SCRIPT, Keyword::UNSAFE_INLINE],
],
```

--------------------------------

### Selecting presets in config/csp.php

Source: https://github.com/spatie/laravel-csp/blob/main/_autodocs/api-reference/presets.md

Configure which presets are applied in the CSP policy. The 'presets' array lists active presets, while 'report_only_presets' lists presets that only report violations without enforcing them.

```php
'presets' => [
    Spatie\Csp\Presets\Basic::class,
    Spatie\Csp\Presets\Intercom::class,
],

'report_only_presets' => [
    Spatie\Csp\Presets\GoogleAnalytics::class,
],
```

--------------------------------

### Clarity::configure

Source: https://github.com/spatie/laravel-csp/blob/main/_autodocs/api-reference/presets-analytics.md

Configures the CSP policy for Microsoft Clarity by adding connect-src, script-src, and img-src directives for clarity.ms and c.bing.com.

```APIDOC
## Clarity::configure

### Description
Configures the CSP policy for Microsoft Clarity by adding connect-src, script-src, and img-src directives for clarity.ms and c.bing.com.

### Method
configure

### Signature
public function configure(Policy $policy): void

### Parameters
- **$policy** (Policy) - Required - The policy instance to configure.

### Behavior
Adds the following directives and sources:
- Directive::CONNECT, Directive::SCRIPT, Directive::IMG -> 'https://*.clarity.ms'
- Directive::CONNECT, Directive::SCRIPT, Directive::IMG -> 'https://c.bing.com'

```

--------------------------------

### Publish csp-config with artisan vendor:publish

Source: https://github.com/spatie/laravel-csp/blob/main/_autodocs/configuration.md

Publishes the config/csp.php configuration file to your application.

```bash
php artisan vendor:publish --tag=csp-config
```
Tokens:
Raw