Configuring a Content Security Policy

Send a restrictive Content-Security-Policy header with nonce-based script authorization where inline scripts are required.

The objective is to understand the behavior and operational limits, not only the method name.

What It Does

Send a restrictive Content-Security-Policy header with nonce-based script authorization where inline scripts are required.

Prerequisites

Use a dedicated development environment and sample data. Where a snippet uses an injected connection, repository, request value or mailer, supply it from your own application setup.

Example 1: Basic Use

A focused working pattern for this topic. Names such as $pdo, $authContext and $repo represent dependencies provided by the application unless initialized in the snippet.

<?php
$nonce = base64_encode(random_bytes(16));
header("Content-Security-Policy: default-src 'self'; script-src 'self' 'nonce-$nonce'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'");
// Pass the same nonce to trusted script tags in the rendered template.

Example 2: A Second Scenario

A second use case that adds a different operation or data flow specific to this topic.

<?php
$nonce = base64_encode(random_bytes(16));
header("Content-Security-Policy: default-src 'none'; script-src 'self' 'nonce-$nonce'; style-src 'self'; base-uri 'self'; frame-ancestors 'none'");
echo 'CSP enabled for this response';

Example 3: Practical Checks

A practical validation, failure or deployment concern specific to this topic.

<?php
$policy = "default-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'";
header('Content-Security-Policy-Report-Only: ' . $policy);
echo 'Collect violations before enforcing';

Important Behavior and Edge Cases

Avoid unsafe-inline and wildcard script sources; roll out report-only mode before enforcing new rules.

For production use, also account for error handling, data validation, resource limits and environment-specific driver behavior.

Comparison with Related Approaches

Common Beginner Mistakes

Key Takeaways

• Send a restrictive Content-Security-Policy header with nonce-based script authorization where inline scripts are required.
• Avoid unsafe-inline and wildcard script sources; roll out report-only mode before enforcing new rules.
• Use this workflow as a focused starting point rather than a substitute for application-level tests.

Choose this API or pattern when its exact semantics match your task, and verify the result against the database driver and runtime used by your application.