NelmioSecurityBundle

The bundle offers two modes for handling HTTPS:

Forced HTTPS/SSL

Forces all requests to go through SSL and sends HSTS headers. Warning: Ensure SSL is working correctly before enabling this.

Configuration keys:

• hsts_max_age: The duration (in seconds) the browser should remember to use HTTPS.
• hsts_subdomains: Whether to include subdomains in the HSTS policy.
• redirect_status_code: The HTTP status code used for the redirect (default is 302).

Flexible HTTPS/SSL

Used when you don't want to force all users to HTTPS, but want to ensure logged-in users are redirected to a secure URL and that session cookies are secure.

Configuration keys:

• cookie_name: The name of the authentication cookie.
• unsecured_logout: Boolean determining if logout is allowed on non-HTTPS connections.

The xss_protection feature enables or disables Microsoft XSS Protection on compatible browsers.

Caution: This feature is non-standard and deprecated. It is highly recommended to use Content Security Policy (CSP) instead.

# config/packages/nelmio_security.yaml
nelmio_security:
    xss_protection:
        enabled: true
        mode_block: true
        report_uri: '%router.request_context.base_url%/nelmio/xss/report'

To reduce noise in your reports, you can enable browser_adaptive mode. This ensures the bundle only sends directives that the specific user agent's browser understands.

Note: This requires parsing the User-Agent, which can be CPU-intensive. It is highly recommended to provide a cached parser service.

```yaml
# config/packages/nelmio_security.yaml
nelmio_security:
    csp:
        enforce:
            browser_adaptive:
                enabled: true
                parser: my_own_parser

<!-- Example service definition for a cached parser --> <service id="my_own_parser" class="Nelmio\SecurityBundle\UserAgent\UAFamilyParser\PsrCacheUAFamilyParser"> <argument type="service" id="app.my_cache.pool"/> <argument type="service" id="nelmio_security.ua_parser.ua_php"/> <argument>604800</argument> </service>

You can configure the bundle to send security violation reports to a specific endpoint using the report_to option. This requires you to separately configure the Reporting API endpoints using the Report-To or Reporting-Endpoints headers (typically via a CSP directive or a separate listener).

# config/packages/nelmio_security.yaml
nelmio_security:
    cross_origin_isolation:
        enabled: true
        paths:
            '^/.*':
                coep:
                    value: require-corp
                    report_to: "coi-endpoint"
                coop:
                    value: same-origin
                    report_to: "coi-endpoint"

To add security features to your Symfony application, require the nelmio/security-bundle package using Composer. If you are using Symfony Flex, the bundle will be automatically enabled. If you are not using Flex, you must enable the bundle manually in your application configuration.

composer require nelmio/security-bundle

To upgrade your hashing algorithm (e.g., from sha256 to sha3-256) without breaking existing user cookies, use the legacy_hash_algo option. This allows the bundle to verify old cookies using the old algorithm while signing new ones with the new one.

Caution: This should only be used temporarily to prevent downgrade attacks.

# config/packages/nelmio_security.yaml
nelmio_security:
    signed_cookie:
        hash_algo: sha3-256
        legacy_hash_algo: sha256

To test security policies without blocking resources, use the report_only: true option. This instructs the bundle to use the Cross-Origin-Embedder-Policy-Report-Only or Cross-Origin-Opener-Policy-Report-Only headers instead of the enforcement headers. This is highly recommended for production testing to identify resources that lack necessary CORP headers before enforcing strict policies.

# config/packages/nelmio_security.yaml
nelmio_security:
    cross_origin_isolation:
        enabled: true
        paths:
            '^/.*':
                coep:
                    value: require-corp
                    report_only: true
                coop:
                    value: same-origin
                    report_only: true

If you want to avoid using 'unsafe-inline', you can use message digests (hashes). The bundle supports configuring the algorithm (default is sha256; options are sha256, sha384, sha512) in the csp.hash.algorithm config key.

Using Twig

Use the {% cspscript %} and {% cspstyle %} tags. These tags automatically compute the digest for the content inside them and include it in the CSP header.

Using ContentSecurityPolicyListener

If you are not using Twig, you can manually add content to the listener, which will compute the digest automatically:

{% cspscript %}
<script>
    window.api_key = '{{ api_key }}';
</script>
{% endcscript %}

$listener->addScript("<script>window.api_key = '{{ api_key }}';</script>");
$listener->addStyle("<style>body { background-color: '{{ bgColor }}'; }</style>");