nesguard

NESGuard SRI Monitor integrates Drupal with NESGuard.cloud to provide advanced JavaScript security through Subresource Integrity (SRI) monitoring. It protects your site from supply chain attacks by ensuring external scripts haven't been tampered with.

Features

- Automatically applies SRI integrity attributes to JavaScript resources based on verified hashes
- Real-time monitoring via WebSockets connection to detect and respond to script changes instantly
- Fallback mechanism for critical scripts like Stripe.js to ensure uninterrupted protection
- Optional Content Security Policy (CSP) header management to further enhance security
- Service-based architecture following Drupal best practices
- Comprehensive logging and debugging capabilities
- Detailed status reporting in Drupal's status report

Post-Installation

1. Set a secure encryption key in your settings.php file:
$settings['nesguard_encryption_key'] = 'YOUR_SECURE_RANDOM_KEY_HERE';
2. Navigate to Administration > Configuration > System > NESGuard SRI Settings
3. Enter your NESGuard Agency Identifier and API Key
4. Enable the module to activate SRI protection
5. Optionally configure CSP settings if needed

The module will automatically fetch monitored script lists from your NESGuard account and apply SRI attributes to those scripts. The client-side JavaScript establishes a WebSocket connection to receive real-time hash updates.

Additional Requirements

- Drupal 9.4+ or Drupal 10+
- PHP 7.4 or higher
- PHP OpenSSL extension
- A NESGuard.cloud account with an active subscription
- Outbound HTTPS and WebSocket connections to nesguard.cloud

Recommended modules/libraries

No additional modules are required, though this module pairs well with security-focused modules like Security Review for a more comprehensive security posture.

Similar projects

While the Security Review module provides general security auditing, and CSP handles Content Security Policy, NESGuard is unique in providing specialized Subresource Integrity protection with real-time monitoring. It's specifically designed to protect against JavaScript supply chain attacks.

Supporting this Module

Development is supported by nesgaurd.com, a service dedicated to improving JavaScript security across the web.

Community Documentation

For detailed information on Subresource Integrity and why it's important for your site's security, visit nesgaurd.com or refer to the Mozilla Developer Network SRI documentation.