Skip to content

c0nrad/caspr

Repository files navigation

Caspr (not under development)

If you are looking for a CSP reporting tool, please check out https://csper.io .

Caspr

Deploy

Caspr is a Content-Security-Policy report endpoint, aggregator, and analyzer.

It contains three parts:

What is Content-Security-Policy?

https://developer.mozilla.org/en-US/docs/Web/Security/CSP/Introducing_Content_Security_Policy

Deployment

Either use Heroku, or to install manually, install NodeJS/npm/MongoDB(>2.6).

git clone https://github.com/c0nrad/caspr.git
cd caspr
npm install
forever bin/www

Options

$> node bin/www --help

Usage: node www [options]

Options:
   -p, --port               Port to run http caspr  [3000]
   --ssl                    Run ssl on port 443  [false]
   --sslKeyFile             SSL key file for ssl  [./bin/certs/key.pem]
   --sslCertFile            SSL certificate file for ssl  [./bin/certs/cert.pem]
   --cappedCollectionSize   Size of report collection in bytes  [0]

SSL

To use caspr with SSL, set sslKeyFIle and sslCertFile to the location of your cert and private key file on disk with --sslKeyFile and --sslCertFIle.

forever bin/www --ssl --sslKeyFile /var/certs/key.pem --sslCertFile /var/certs/cert.pem

Capped Collections

MongoDB supports capped collections, meaning you can specifiy a maximum size for the reports collection in your DB.

For my own deployments I usually set it around 1GB, but on Heroku the maximum size of the free version is .5GB.

To use capped collections, either set it manually or pass the size in bytes you'd like the reports collection to be.

forever bin/www --capped 500000000 // .5GB
use caspr
db.runCommand({convertToCapped: 'reports', size: 500000000 })

http://docs.mongodb.org/manual/reference/command/convertToCapped/

How do I dump all reports?

All reports are stored within MongoDB. So a script such as the following can be used to dump all reports into a json file

dump.js

cursor = db.getSiblingDB('caspr').reports.find();
while ( cursor.hasNext() ) {
   printjson( cursor.next() );
}
mongo dump.js > dump.json

Contact

c0nrad@c0nrad.io

About

Content-Security-Policy report aggregator/analyzer

Topics

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published