PHPAML

Documentation · Chapter 08

Give the browser
explicit boundaries.

Security headers ask the browser to reject risky behavior before the page can use it.

We secure reading-list in layers without pretending one option is enough.

SecurityHeadersMiddleware is enabled by default

phpaml — zsh
"middlewares": [
  "PHPAML\\Middleware\\SecurityHeadersMiddleware"
]

The middleware wraps the response so protections remain present even on error pages.

What the main headers enforce

Content-Security-Policyallowed sources for scripts, styles, forms, and objects
X-Frame-Options: DENYforbids framing
X-Content-Type-Optionsprevents MIME type guessing
Referrer-Policylimits address information sent
Permissions-Policydisables camera, microphone, geolocation
HSTSforces HTTPS after a secure request

Why a nonce for scripts?

PHPAML generates an unpredictable value for every response. CSP allows only same-site scripts or scripts carrying that nonce. This reduces injected-script execution without globally allowing unsafe-inline.

Current style status

AML View still emits some trusted style attributes. CSP therefore temporarily allows unsafe-inline for styles, while scripts remain nonce-protected.