Cache-Control in PHP konfigurieren

<?php
// security-headers.php — Cache-Control

if (!headers_sent()) {
    // Dynamische Seiten: Kein Caching
    header('Cache-Control: no-store, no-cache, must-revalidate');
    header('Pragma: no-cache');
}

// Fuer statische API-Responses:
// header('Cache-Control: public, max-age=300, s-maxage=600');

// Fuer unveraenderliche Assets (versioniert):
// header('Cache-Control: public, max-age=31536000, immutable');

; .user.ini — Cache-Control als Default
; Setzt no-store fuer ALLE PHP-Seiten als sicheren Default

auto_prepend_file = "/var/www/html/security-headers.php"

; ACHTUNG: no-store global = kein Browser-Caching
; Einzelne Scripts koennen den Header ueberschreiben
; PHP-FPM Cache-TTL: 5 Minuten
; Nach Aenderung: systemctl restart php-fpm

<?php
// src/Middleware/CacheControlMiddleware.php — PSR-15

namespace App\Middleware;

use Psr\Http\Message\ResponseInterface;
use Psr\Http\Message\ServerRequestInterface;
use Psr\Http\Server\MiddlewareInterface;
use Psr\Http\Server\RequestHandlerInterface;

class CacheControlMiddleware implements MiddlewareInterface
{
    public function process(
        ServerRequestInterface $request,
        RequestHandlerInterface $handler
    ): ResponseInterface {
        $response = $handler->handle($request);
        $contentType = $response->getHeaderLine('Content-Type');

        if (str_contains($contentType, 'text/html')) {
            return $response->withHeader(
                'Cache-Control',
                'no-store, no-cache, must-revalidate'
            );
        }
        return $response->withHeader(
            'Cache-Control',
            'public, max-age=3600'
        );
    }
}