README

PSR-15 middleware for Neos Flow that adds configurable security headers to every HTTP response.

Features

• Context-aware header values — apply different sources for the Neos backend, development, and Monocle
• Fully configurable contexts via Settings.yaml — no hardcoded paths
• Variable substitution in header values ({HTTP_HOST}, {REQUEST_URI}, {FLOW_CONTEXT})
• Ships with strict defaults; extend per project via Settings.yaml

Installation

composer require jvmtech/security-headers

Default headers

The middleware runs after routing, meaning any IP allowlist middleware at the routing step executes before security headers are applied.

Contexts

Contexts are named conditions evaluated against each request. For each directive, the highest-position active context that defines a value wins exclusively — its value is used as-is, with no concatenation. default (position 0) is the fallback when no higher-priority context defines a value for that directive. If the winning context doesn't define a value for a given directive, the next highest-position active context is tried.

Built-in contexts

Defining custom contexts

Add to your site package's Configuration/Settings.yaml:

JvMTECH:
  Flow:
    SecurityHeaders:
      contexts:
        api:
          position: 300
          uriPrefixes: ['/api/', '/graphql/']
        staging:
          position: 150
          flowContexts: ['Production/Staging']
        apiInDevelopment:
          position: 400
          uriPrefixes: ['/api/']
          flowContexts: ['Development']
          # operator: 'and' is the default
        backendOrStaging:
          position: 100
          uriPrefixes: ['/neos/']
          flowContexts: ['Production/Staging']
          operator: 'or'

Each context supports:

If only uriPrefixes is set, only the URI is checked. If only flowContexts is set, only the context is checked.

Header configuration

Override any header value in your site package's Configuration/Settings.yaml. All keys are merged, so you only need to specify what differs from the defaults.

JvMTECH:
  SecurityHeaders:
    Headers:
      Content-Security-Policy:
        img-src:
          default: "'self' data: i.ytimg.com www.youtube.com"
          monocle: "picsum.photos fastly.picsum.photos"
        frame-src: "'self' youtube.com www.youtube.com player.vimeo.com"
        report-uri: "/csp-violation-report/"
      Strict-Transport-Security: "max-age=7776000; includeSubDomains"

For context-aware CSP directives, use a map keyed by context name. All active contexts for the current request are concatenated:

script-src-elem:
  default: "'self' cdn.example.com"
  backend: "'unsafe-inline'"
  development: "'unsafe-inline' cdn.tailwindcss.com"
  myCustomContext: "extra.example.com"

Variable substitution

The following placeholders are replaced at runtime inside any header value: