⚡ zappzarapp/security

Comprehensive PHP security library providing CSP, Security Headers, CSRF protection, Secure Cookies, Password Validation, Input Sanitization, Rate Limiting, SRI, Secrets Loading, Encryption, Session Security, TOTP two-factor authentication, Signed URLs, and Security Event Logging.

Highlights

• All-in-one — 17 security modules in a single, composable package
• Secure by default — strict CSP, no unsafe-*, HTTPS-first
• Framework-agnostic — works with any PHP 8.4+ application
• Immutable & type-safe — readonly classes, enums, with*() API
• Quality-backed — PHPStan Level 8, Psalm Level 1, 100% Mutation Score, Deptrac architecture enforcement
• PSR-compatible — PSR-3 (Logging), PSR-15 (Middleware), PSR-18 (HTTP Client)

Modules

Module	Description	Key Classes
CSP	Content Security Policy header building and violation reporting	CspDirectives, HeaderBuilder, NonceGenerator, CspReportParser
Headers	Security headers (HSTS, Permissions-Policy, etc.)	SecurityHeaders, SecurityHeadersBuilder
CSRF	Cross-Site Request Forgery protection	CsrfProtection, CsrfConfig
Cookie	Secure cookie handling	SecureCookie, CookieBuilder, CookieOptions
Encryption	XChaCha20-Poly1305 authenticated encryption	SymmetricEncryptor, EnvelopeEncryptor, EncryptionKey, KeyRingEncryptor
Password	Password validation and hashing	PasswordPolicy, PwnedPasswordChecker, PepperedPasswordHasher
Sanitization	Input sanitization (HTML, SQL, URI, Path) and file upload validation	HtmlSanitizer, UriSanitizer, PathValidator, UploadValidator
RateLimiting	Rate limiting with multiple algorithms	DefaultRateLimiter, RateLimitConfig
SRI	Subresource Integrity hash generation	SriHashGenerator, IntegrityAttribute
Secrets	Docker/file-based secret loading	SecretLoader, SecretValue, FileSecretSource
Session	Session hardening and fixation protection	SessionGuard, SessionConfig, SessionConfigurator
SignedUrl	HMAC-signed URLs with mandatory expiry	UrlSigner, SigningKey
TOTP	Time-based one-time passwords (RFC 6238)	TotpAuthenticator, TotpSecret, ProvisioningUri, RecoveryCodeGenerator
Analyzer	Security header analysis and auditing	SecurityHeaderAnalyzer, AnalysisResult
Scanner	CLI security header scanner	ScanCommand, StreamHeaderFetcher
Middleware	PSR-15 middleware for drop-in framework integration	SecurityHeadersMiddleware, CspMiddleware, CspReportHandler, CsrfMiddleware, DoubleSubmitCsrfMiddleware, RateLimitMiddleware, CorsMiddleware
Logging	Security event logging	SecurityAuditLogger, SecurityEvent

Requirements

• PHP ^8.4
• ext-dom
• ext-libxml
• ext-sodium

Installation

composer require zappzarapp/security

Quick Start

Security Headers

use Zappzarapp\Security\Headers\Builder\SecurityHeadersBuilder;

$headers = SecurityHeadersBuilder::recommended()->build();
foreach ($headers as $name => $value) {
    header("{$name}: {$value}");
}

CSP with Nonces

use Zappzarapp\Security\Csp\HeaderBuilder;
use Zappzarapp\Security\Csp\Directive\CspDirectives;
use Zappzarapp\Security\Csp\Nonce\NonceGenerator;

$generator = new NonceGenerator();
$csp = HeaderBuilder::build(CspDirectives::strict(), $generator);
header("Content-Security-Policy: {$csp}");

$nonce = $generator->get();
echo "<script nonce=\"{$nonce}\">console.log('Safe!');</script>";

CSRF Protection

use Zappzarapp\Security\Csrf\CsrfProtection;
use Zappzarapp\Security\Csrf\Storage\SessionCsrfStorage;

$csrf = new CsrfProtection(new SessionCsrfStorage());

// Generate token for form
$token = $csrf->generateToken();
echo '<input type="hidden" name="_token" value="' . $token->value() . '">';

// Validate on submission
if (!$csrf->validateToken($_POST['_token'])) {
    throw new Exception('CSRF validation failed');
}

Input Sanitization

use Zappzarapp\Security\Sanitization\Html\HtmlSanitizer;
use Zappzarapp\Security\Sanitization\Path\PathValidationConfig;
use Zappzarapp\Security\Sanitization\Path\PathValidator;

// Sanitize HTML (removes dangerous tags/attributes)
$sanitizer = new HtmlSanitizer();
$safe = $sanitizer->sanitize($userInput);