Provide an API to calculate the hash of a script or style to be included inline
https://www.w3.org/TR/CSP/#grammardef-hash-source

e.g.

class Csp {
  protected static $hashAlgorithms = ['sha256', 'sha384', 'sha512'];

  public static function hashSource($data, $algo = 'sha256') {
    if (!in_array($algo, static:hashAlgorithms)) {
      throw new \InvalidArgumentException('Hash algorithm not supported');
    }
    return base64_encode(hash($algo, $data));
  }
}

Comments

gapple created an issue. See original summary.

gapple’s picture

Status: Active » Postponed
Related issues: +#2895245: API for modules to alter policy

This won't be vary useful until it's possible to dynamically add directive sources.

  • gapple committed 3a78064 on 8.x-1.x
    Issue #3047214: API for calculating hash of inline scripts
    
gapple’s picture

Status: Postponed » Fixed

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.