Erweiterte Header für Shopware 6

// src/Subscriber/SecurityHeaderSubscriber.php
namespace App\Subscriber;

use Symfony\Component\EventDispatcher\EventSubscriberInterface;
use Symfony\Component\HttpKernel\Event\ResponseEvent;
use Symfony\Component\HttpKernel\KernelEvents;

class SecurityHeaderSubscriber implements EventSubscriberInterface
{
    public static function getSubscribedEvents(): array
    {
        return [
            KernelEvents::RESPONSE => ['onResponse', -10],
        ];
    }

    public function onResponse(ResponseEvent $event): void
    {
        $response = $event->getResponse();

        // Origin-Agent-Cluster — Prozess-Isolierung (Spectre-Schutz)
        $response->headers->set('Origin-Agent-Cluster', '?1');

        // X-DNS-Prefetch-Control — DNS-Prefetching steuern
        $response->headers->set('X-DNS-Prefetch-Control', 'off');

        // X-Permitted-Cross-Domain-Policies — Flash/PDF blockieren
        $response->headers->set('X-Permitted-Cross-Domain-Policies', 'none');

        // X-Download-Options — IE Download-Öffnung verhindern
        $response->headers->set('X-Download-Options', 'noopen');
    }
}

# Nginx — Alternative für Self-Hosted
# Alle erweiterten Header auf Server-Ebene

# Prozess-Isolierung (Spectre-Schutz)
add_header Origin-Agent-Cluster "?1" always;

# DNS-Prefetching deaktivieren (Privacy)
add_header X-DNS-Prefetch-Control "off" always;

# Flash/PDF Cross-Domain-Policies blockieren
add_header X-Permitted-Cross-Domain-Policies "none" always;

# IE Download-Öffnung verhindern
add_header X-Download-Options "noopen" always;

<!-- services.xml — Subscriber registrieren -->
<service id="App\Subscriber\SecurityHeaderSubscriber">
    <tag name="kernel.event_subscriber"/>
</service>