/ 
Net-IMP-0.23
River stage one • 1 direct dependent • 1 total dependent
/ Net::IMP::HTTP_AddCSPHeader

NAME

AHAPI::HTTP_AddCSPHeader - adds Content Security Policy header and more

DESCRIPTION

This module is experimenting with automatically adding Content Security Policy to HTTP responses and more. It uses the ContentSecurityPolicy module to

  • inject restrictive but report-only CSP header into HTTP response if none exists

  • intercept CSP violation reports and extend CSP policy accordingly

  • track (and maybe check) referers from HTTP requests

it interacts with the CSP module by

  • specifying the backend to use, using the parameter csp_backend in new_factory or new_analyzer

  • creating a new policy object when receiving a request with $policy = $csp->policy_from_request_header

  • determining if a request is a violation report using $policy-is_report>. In this case call $csp-add_report>, so that the CSP can be adjusted according to the report.

  • checking the requests Referer header using $policy-valid_referer>. The policy can cause the request to be blocked.

  • calling $policy-change_response_header> on the response header to let the CSP module add the appropriate CSP header.

AUTHOR

Steffen Ullrich <sullr@cpan.org>

COPYRIGHT

Copyright by Steffen Ullrich.

This module is free software; you can redistribute it and/or modify it under the same terms as Perl itself.