Configuring Content Security Policy (CSP) in TYPO3

TYPO3

Description

TYPO3 includes a backend module for CSP reporting and supports two mechanisms for inline script and style allowlisting: nonce-based and hash-based CSP. Nonces are random per-request tokens and prevent HTTP response caching. Since TYPO3 v14, hash-based CSP is available as an explicit opt-in via csp.yaml, allowing responses to be cached by reverse proxies or static file cache extensions while still enforcing a strict Content Security Policy.

Goals

• I know that TYPO3 includes a backend module specifically designed for CSP reporting and I understand its main functionality.
• I know how to use the TYPO3 backend module to log CSP rule violations and how it helps to identify security risks.
• I know how to use the TYPO3 backend module to dynamically adjust CSP headers, for example to allow specific content such as YouTube iframes.
• I know that the reporting URL for CSP violations can be configured separately for frontend and backend, including the use of external monitoring services.
• I know the difference between nonce-based and hash-based CSP, and when to use each approach.
• I know how to enable hash-based CSP for a site by setting behavior.useHash: true in csp.yaml, and why setting behavior.useNonce: false is required for cacheable responses.
• I know that the f:asset.script and f:asset.css ViewHelpers use the csp argument (formerly useNonce) to control whether a hash or nonce is applied to an asset.
• I know that the f:asset.styleAttr ViewHelper registers inline style values with the style-src-attr CSP directive via hash collection.
• I know the importance of regularly monitoring and updating CSP rules to maintain a balance between security and functionality.

Maintainer

Oliver Thiele Web Development Oliver Thiele