Erweiterte Security Header in PHP konfigurieren

<?php
// security-headers.php — Erweiterte Header

if (!headers_sent()) {
    // Origin-Agent-Cluster: Prozessisolation
    header('Origin-Agent-Cluster: ?1');

    // X-DNS-Prefetch-Control: DNS-Prefetch steuern
    header('X-DNS-Prefetch-Control: off');

    // X-Download-Options: IE Download-Schutz
    header('X-Download-Options: noopen');

    // X-Permitted-Cross-Domain-Policies
    header('X-Permitted-Cross-Domain-Policies: none');
}

; .user.ini — Auto-Prepend für erweiterte Header
; Alle erweiterten Header werden automatisch gesetzt

auto_prepend_file = "/var/www/html/security-headers.php"

; Die security-headers.php enthält ALLE Header:
; - Standard-Header (HSTS, CSP, etc.)
; - Erweiterte Header (hier konfiguriert)
; PHP-FPM Cache-TTL: 5 Minuten

<?php
// src/Middleware/AdvancedHeadersMiddleware.php — PSR-15

namespace App\Middleware;

use Psr\Http\Message\ResponseInterface;
use Psr\Http\Server\MiddlewareInterface;
use Psr\Http\Server\RequestHandlerInterface;

class AdvancedHeadersMiddleware implements MiddlewareInterface
{
    private const HEADERS = [
        'Origin-Agent-Cluster' => '?1',
        'X-DNS-Prefetch-Control' => 'off',
        'X-Download-Options' => 'noopen',
        'X-Permitted-Cross-Domain-Policies' => 'none',
    ];

    public function process($request, $handler): ResponseInterface
    {
        $response = $handler->handle($request);
        foreach (self::HEADERS as $name => $value) {
            $response = $response->withHeader($name, $value);
        }
        return $response;
    }
}