csp-builder

For PHP integration, have you considered hooking into CSP-Builder? (It's MIT licensed, so you can just make a private fork for internal use forever, but if you upstream your changes, I'd greatly appreciate it.) https://github.com/paragonie/csp-builder

SEEKING WORK | REMOTE | Orlando, FL Need to shore up the security of your web-based software? Need someone who can work within real-world security requirements? PHP powers over 82% of websites on the Internet today, though it's often shunned by other information security professionals. For most companies, rewriting everything from scratch in a different language is not a viable strategy for minimizing the risk to themselves or their customers. Is it possible for software written in PHP to be secure (in spite of what other security experts say)? Yes. If you still have doubts, get in touch. My research and professional background mostly consists of software development, web application security, applied cryptography, code auditing, and penetration testing. You may find much of my recent open source security research here: https://paragonie.

Static CSP headers are pretty cool, but they also support nonces, which look like this: // In the header: 'nonce-+2K9dA2eE3a/C16nYmoBr6Dj' // In the HTML: <script nonce="+2K9dA2eE3a/C16nYmoBr6Dj">/* your code here */</script> CSP nonces are useful for having dynamically generated Javascript without allowing unsafe-inline. Check out CSP-Builder if you want a simple interface for adding them to your project: https://github.com/paragonie/csp-builder <?php use \ParagonIE\CSPBuilder\CSPBuilder; $csp = CSPBuilder::fromFile('/path/to/source.json'); ?> <!-- snip --> <script nonce=<?php echo $csp->nonce('script-src'); ?>>

SEEKING WORK: Application Security, Cryptography, Web Development REMOTE Only - (Located in Orlando, FL) What do WordPress, Joomla, Symfony, CodeIgniter, the Facebook SDK, CakePHP, Yii Framework, several implementations of RNCryptor in various programming languages, and Zend Framework's Cryptography Library all have in common? They've all benefited from my open source security research. Whether you're a startup looking to eliminate unnecessary risk while you focus on growth or a large business that needs to protect your assets, I can help. A brief sample of software I've written: * https://github.com/paragonie/halite - Halite: A PHP libsodium wrapper that emphasizes ease-of-use, secure defaults, and type-safety. * https://github.com/paragonie/random_compat Random_compat: Use the new PHP 7 CSPRNG functions in PHP 5 projects. * https://gith

If anyone read this and thought, "I should add a Content-Security-Policy to my website," I've written and published an open source tool for building CSP headers programmatically and/or from a JSON configuration file. https://github.com/paragonie/csp-builder

One of the projects I'm working on aims to make it easier to integrate CSP headers into web applicatons. https://github.com/paragonie/csp-builder I'm working this week to integrate it into another project we're developing. (It's MIT licensed, so have fun with it.)