You are here

Home » API reference » Security Kit 8

seckit.schema.yml in Security Kit 8

Same filename and directory in other branches
  1. 2.x config/schema/seckit.schema.yml
config/schema/seckit.schema.yml

File

config/schema/seckit.schema.yml
View source 
  1. seckit.settings:

  2.   type: config_object

  3.   label: 'SecKit settings'

  4.   mapping:

  5.     seckit_xss:

  6.       type: mapping

  7.       label: 'XSS'

  8.       mapping:

  9.         csp:

  10.           type: mapping

  11.           label: 'CSP'

  12.           mapping:

  13.             checkbox:

  14.               type: boolean

  15.               label: 'Send HTTP response header'

  16.             vendor-prefix:

  17.               type: mapping

  18.               label: 'Vendor prefixed CSP headers'

  19.               mapping:

  20.                 x:

  21.                   type: boolean

  22.                   label: 'Send X-Content-Security-Policy HTTP response header'

  23.                 webkit:

  24.                   type: boolean

  25.                   label: 'Send X-WebKit-CSP HTTP response header'

  26.             report-only:

  27.               type: boolean

  28.               label: 'Report only'

  29.             default-src:

  30.               type: string

  31.               label: 'Default src'

  32.             script-src:

  33.               type: string

  34.               label: 'Script src'

  35.             object-src:

  36.               type: string

  37.               label: 'Object src'

  38.             style-src:

  39.               type: string

  40.               label: 'Style src'

  41.             img-src:

  42.               type: string

  43.               label: 'Image src'

  44.             media-src:

  45.               type: string

  46.               label: 'Media src'

  47.             frame-src:

  48.               type: string

  49.               label: 'Frame src'

  50.             frame-ancestors:

  51.               type: string

  52.               label: 'Frame ancestors'

  53.             child-src:

  54.               type: string

  55.               label: 'Child src'

  56.             font-src:

  57.               type: string

  58.               label: 'Font src'

  59.             connect-src:

  60.               type: string

  61.               label: 'Connect src'

  62.             report-uri:

  63.               type: string

  64.               label: 'Report URI'

  65.             upgrade-req:

  66.               type: boolean

  67.               label: 'Upgrade Insecure Requests'

  68.             policy-uri:

  69.               type: string

  70.               label: 'Policy URI'

  71.         x_xss:

  72.           type: mapping

  73.           label: 'X-XSS'

  74.           mapping:

  75.             seckit_x_xss_option_disable:

  76.               type: string

  77.               label: 'Disabled'

  78.             seckit_x_xss_option_0:

  79.               type: string

  80.               label: '0'

  81.             seckit_x_xss_option_1:

  82.               type: string

  83.               label: '1'

  84.             seckit_x_xss_option_1_block:

  85.               type: string

  86.               label: '1; mode=block'

  87.             select:

  88.               type: integer

  89.               label: 'Select'

  90.     seckit_csrf:

  91.       type: mapping

  92.       label: 'CSRF'

  93.       mapping:

  94.         origin:

  95.           type: boolean

  96.           label: 'Origin'

  97.         origin_whitelist:

  98.           type: string

  99.           label: 'Origin whitelist'

  100.     seckit_clickjacking:

  101.       type: mapping

  102.       label: 'Clickjacking'

  103.       mapping:

  104.         js_css_noscript:

  105.           type: boolean

  106.           label: 'Enable JavaScript + CSS + Noscript protection'

  107.         noscript_message:

  108.           type: string

  109.           label: 'Custom text for disabled JavaScript message'

  110.         x_frame:

  111.           type: string

  112.           label: 'X-Frame'

  113.         x_frame_allow_from:

  114.           type: string

  115.           label: 'X-Frame-ALLOW-FROM'

  116.     seckit_ssl:

  117.       type: mapping

  118.       label: 'HTTP Strict Transport Security'

  119.       mapping:

  120.         hsts:

  121.           type: boolean

  122.           label: 'Enable HTTP String Transport Security'

  123.         hsts_subdomains:

  124.           type: boolean

  125.           label: 'Include subdomains'

  126.         hsts_max_age:

  127.           type: integer

  128.           label: 'Max-Age'

  129.         hsts_preload:

  130.           type: boolean

  131.           label: 'HSTS Preload'

  132.     seckit_ct:

  133.       type: mapping

  134.       label: 'Expect-CT'

  135.       mapping:

  136.         expect_ct:

  137.           type: boolean

  138.           label: 'Expect-CT'

  139.         max_age:

  140.           type: integer

  141.           label: 'Max-Age'

  142.         report_uri:

  143.           type: string

  144.           label: 'Report uri'

  145.         enforce:

  146.           type: boolean

  147.           label: 'Enforce'

  148.     seckit_fp:

  149.       type: mapping

  150.       label: 'Feature policy'

  151.       mapping:

  152.         feature_policy:

  153.           type: boolean

  154.           label: 'Feature policy'

  155.         feature_policy_policy:

  156.           type: string

  157.           label: 'Policy'

  158.     seckit_various:

  159.       type: mapping

  160.       label: 'Various'

  161.       mapping:

  162.         from_origin:

  163.           type: boolean

  164.           label: 'From-Origin'

  165.         from_origin_destination:

  166.           type: string

  167.           label: 'Allow loading content to'

  168.         referrer_policy:

  169.           type: boolean

  170.           label: 'Referrer-Policy'

  171.         referrer_policy_policy:

  172.           type: string

  173.           label: 'Select policy'

  174.         disable_autocomplete:

  175.           type: boolean

  176.           label: 'Disable autocomplete'