Cross-Origin Headers in Drupal konfigurieren

<?php
// modules/custom/security_headers/src/EventSubscriber/CrossOriginSubscriber.php

namespace Drupal\security_headers\EventSubscriber;

use Symfony\Component\EventDispatcher\EventSubscriberInterface;
use Symfony\Component\HttpKernel\Event\ResponseEvent;
use Symfony\Component\HttpKernel\KernelEvents;

class CrossOriginSubscriber implements EventSubscriberInterface {

  public static function getSubscribedEvents() {
    return [KernelEvents::RESPONSE => ['onResponse', 0]];
  }

  public function onResponse(ResponseEvent $event) {
    $response = $event->getResponse();

    // Cross-Origin-Opener-Policy
    $response->headers->set('Cross-Origin-Opener-Policy',
      'same-origin');

    // Cross-Origin-Resource-Policy
    $response->headers->set('Cross-Origin-Resource-Policy',
      'same-origin');

    // Cross-Origin-Embedder-Policy
    // VORSICHT: Kann externe Ressourcen blockieren!
    $response->headers->set('Cross-Origin-Embedder-Policy',
      'require-corp');
  }
}

# .htaccess — Cross-Origin Headers
<IfModule mod_headers.c>
  Header always set Cross-Origin-Opener-Policy "same-origin"
  Header always set Cross-Origin-Resource-Policy "same-origin"
  Header always set Cross-Origin-Embedder-Policy "require-corp"
</IfModule>