Explicit CSP

Explicit CSP helps Drupal site builders define and deliver Content Security Policy (CSP) headers with environment-aware, service-based configuration, so third-party integrations can stay secure and maintainable across environments.

Features

• Service-first CSP configuration model.
• Environment-aware service blocks (different directives/URLs per environment).
• Support for both enforce mode and report-only mode.
• Optional strict-dynamic behavior for script policies.
• Optional upgrade-insecure-requests toggle.
• CSP reporting support with report-uri, report-to, and Reporting-Endpoints.
• Route-level CSP exclusion support for special endpoints.
• Fallback middleware for responses that miss normal CSP injection.
• Twig nonce helper for inline script nonce usage.

Use cases:

• Managing CSP centrally in Drupal instead of web server snippets.
• Using different API or script endpoints in dev/test/stage/prod.
• Rolling out CSP safely with report-only first, then enforce.

Post-Installation

• Enable the module.
• Configure explicit_csp.settings (config import, settings.php override, or admin form).
• Set allowed environments, fallback environment, and enforce/report-only mode.
• Define reporting settings if you want CSP violation reports.
• Define service blocks under services with environments + directives.
• Clear caches and validate response headers in browser dev tools.
• Recommended: start in report-only mode before enabling enforce mode.

• The module ships with minimal install defaults; site policy should be supplied via site config.
• The recommended service syntax is: one service key with a list of environment blocks.

Additional Requirements

• Drupal core 10 or 11.
• No mandatory external PHP libraries beyond Drupal core dependencies.
• A reporting endpoint is required only if CSP reporting is enabled.

Recommended modules/libraries

• CSP report collector or monitoring backend (for example, Sentry-based ingestion).
• Drush/config workflow tooling for environment-specific policy deployment.

Similar projects

• CSP is more UI configuration driven and doesn't natively support per-environment configuration or service-based definitions.

Supporting this Module

The developer is available for consulting. Issue reports, merge requests, review feedback, and testing contributions are welcome.