Exclude NelmioSecurityBundle from API routes about nelmiosecuritybundle HOT 5 CLOSED

Hello @thomas2411

You can disable these features based on the content-type of the response. For instance:

nelmio_security:
    clickjacking:
        content_types: ['text/html']
    csp:
        content_types: ['text/html']

from nelmiosecuritybundle.

Last but not least, I strongly ** do not recommend** you to disable the content-type sniffing header on APIs, please consider OWASP recommendations https://www.owasp.org/index.php/REST_Security_Cheat_Sheet#Send_security_headers

from nelmiosecuritybundle.

Something like that does exist for clickjacking but not for the no-sniff or csp (hosts only) 🤔
But adding paths may not be what you want, instead I would favor a RequestMatcher service-id.

from nelmiosecuritybundle.

I think this is beyond my knowledge. You suggest to add RequestMatcher service which will remove these items from the response headers if this is an API call?

from nelmiosecuritybundle.

No suggest to add an option to the Bundle's to clickjacking configuration to allow configuring a custom RequestMatcher which determines if this header should be added or not.

But I'm not this follows the philosophy of the bundle's configuration, and authors have a different idea 😃

from nelmiosecuritybundle.