IntegerNet_SansecWatch Module

This module allows the integration CSP rules from Sansec Watch (https://sansec.watch/) into Magento without the need for file manipulations and a re-deployment

Setup

composer require integer-net/magento2-sansec-watch
bin/magento module:enable IntegerNet_SansecWatch
bin/magento setup:upgrade

Configuration

The configuration can be found under Stores > Configuration > IntegerNet > Sansec Watch.
Enable Sansec Watch and enter its project ID. You can find the ID in the project URL after navigating to https://sansec.watch/d/account/list and selecting a project (for example, 685769a2-38a4-4d06-a19a-67a528197f51).

Enablement and the project ID can be configured at the Default or Store View scope. A store view inherits the Default configuration unless it has its own values. These settings are not configurable at Website scope. Policies and update status are saved per store view; if a store view has no policies yet, it uses the Default policy set.

Scheduled policy updates are disabled by default. To enable them, set Enable cron job at Default scope. This global setting controls the cron job that updates policies for all enabled store views.

How it works

The policies are fetched from the Sansec Watch API and saved into a database table (integernet_sansecwatch_policies)
When Magento collects the CSP rules, it uses the Magento\Csp\Model\CompositePolicyCollector class and this module adds
a collector to this class, which will read the policies from the database table and add them to the existing policies.

Once policies are fetched from Sansec Watch, the result will be hashed and further updates are only executed, if the
newly fetched policies differ from the existing ones. (This is handled via the entry integernet_sansecwatch in the flag table)

Full Page Cache (FPC)

After policies are updated (either by an updated list from sansec watch or by force), the FPC will be, depending on the configuration either cleared, invalidated or ignored.

Usage

Backend

Directly below the configuration is a button, Update Policies Now, which will fetch and update the policies on demand.
This will do a forced update, where rules are updated, even if the hashes of the old and new policies match.

Command Line

An update can be triggered via bin/magento integer-net:sansec-watch:update
This updates policies for every enabled store view and by default only saves changes if the hashes of the old and new policies differ.

To update only one store view, pass its ID or code with --store-id:

bin/magento integer-net:sansec-watch:update --store-id=default

A dry-run is possible by adding the --dry-run flag, which fetches and outputs the policies without updating the database.

If an update should be force (regardless of the hashes), the --force flag can be added.

Cronjob

The policies are also fetched via the cron job integernet_sansecwatch_update, which runs daily at 01:05 (cron expression: 5 1 * * *) when Enable cron job is enabled at Default scope.
This will also only update the database, if the hashes of the old and new policies do not match.

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog,
and this project adheres to Semantic Versioning.

[Unreleased]

Added

• Added a global-only configuration option to enable scheduled policy updates, disabled by default.

Changed

• Moved Sansec Watch enablement, project IDs, policy storage, and update status to store-view scope.

[2.1.0]

Added

• Added backend configuration for CSP fetch-policy flags per supported directive, including inherited fallback settings.
• Added website/store-scoped configuration for Sansec Watch and CSP policy settings.
• Added a link to MDN’s Content Security Policy directive documentation in the backend configuration.
• Added an injectable API URL provider interface for Sansec Watch-compatible services.

Changed

• Generated CSP fetch policies using the configured flags for each directive instead of one global set of flags.
• Updated the admin templates to render inline styles through Magento’s secure HTML renderer.

2.0.1 - 2026-07-17

Changed

• Replace deprecated ConvertKeysToCamelCase with MapKeysToCamelCase in SansecWatchFlagMapper

Fixed

• Updated the changelog with the missing entry for 2.0.0
• Fix bitbucket pipeline

2.0.0 - 2026-07-17

Changed

• Raised the minimum supported PHP version to 8.3.
• Added compatibility with Symfony 8 components.
• Updated Valinor to 2.4 and adapted Sansec Watch flag mapping accordingly.
• Updated the development and CI toolchain for PHP 8.5, including PHPUnit 12 and PHPStan 2.

Fixed

• Ensured policies loaded from the database are returned as a sequential list.

1.1.1 - 2026-05-11

Fixed

• Use heredoc instead of nowdoc to render scripts with the SecureHtmlRenderer (prevent problems with processed templates)

1.1.0 - 2026-04-03

Added

• Added policy search in the admin configuration.
• Added sorting for the displayed policy list.
• Added a German (de_DE) translation for admin texts.

Changed

• Collapsed long policy lists by default in the admin UI.
• Hid labels for informational fields that are not editable configuration values.
• Made admin UI strings translatable.

Fixed

• Added an explicit empty-state message when no policies are available.

1.0.12 - 2025-09-23

Changed

• Memoized policy fetches to avoid repeated requests during a single update flow.
• Disabled inline policies by default.

1.0.10 - 2025-02-20

Fixed

• Sorted policies before calculating the change hash so identical policy sets no longer trigger incorrect update detection.

1.0.9 - 2025-02-14

Added

• Added a status indicator for the report URI configuration.

Changed

• Added compatibility with symfony/http-client 5.x.

Fixed

• Prevented policies from being loaded when the module is disabled.

1.0.7 - 2024-12-02

Added

• Added an admin action that links directly to the Sansec dashboard.
• Added default button styling for the dashboard shortcut.

1.0.6 - 2024-11-30

Changed

• Made the default Sansec policy fetch parameters configurable.
• Stopped enabling strict-dynamic by default.

1.0.4 - 2024-11-17

Fixed

• Resolved policy table names through Magento's ResourceConnection to improve compatibility with customized database table names.

1.0.3 - 2024-11-17

Changed

• Added compatibility with symfony/http-client 7.

1.0.2 - 2024-11-05

Fixed

• Added support for Magento installations that use database table prefixes.

1.0.1 - 2024-10-29

Changed

• Changed the package license to MIT.

1.0.0 - 2024-10-18

Added

• Initial release of the Magento integration for importing CSP policies from Sansec Watch.
• Added scheduled and manual policy updates, including CLI support.
• Added an admin policy list and backend timestamps for the last checks and updates.
• Added full page cache handling after policy updates.
• Added extension points for customizations.