Cross-Origin Headers in PHP konfigurieren

<?php
// security-headers.php — Cross-Origin Headers

if (!headers_sent()) {
    // COOP — Browsing-Kontext isolieren
    header('Cross-Origin-Opener-Policy: same-origin');

    // CORP — Ressourcen vor Cross-Origin-Zugriff schuetzen
    header('Cross-Origin-Resource-Policy: same-origin');

    // COEP — nur mit expliziter Erlaubnis laden
    // Vorsicht: Blockiert Cross-Origin-Ressourcen ohne CORS
    header('Cross-Origin-Embedder-Policy: require-corp');
}

; .user.ini — Auto-Prepend fuer Cross-Origin Headers

auto_prepend_file = "/var/www/html/security-headers.php"

; Die security-headers.php wird vor jedem PHP-Script
; geladen — Cross-Origin Headers werden garantiert
; vor jeder Ausgabe gesetzt.
;
; PHP-FPM Cache-TTL: 5 Minuten
; Nach Aenderung: systemctl restart php-fpm

<?php
// src/Middleware/CrossOriginMiddleware.php — PSR-15

namespace App\Middleware;

use Psr\Http\Message\ResponseInterface;
use Psr\Http\Message\ServerRequestInterface;
use Psr\Http\Server\MiddlewareInterface;
use Psr\Http\Server\RequestHandlerInterface;

class CrossOriginMiddleware implements MiddlewareInterface
{
    public function process(
        ServerRequestInterface $request,
        RequestHandlerInterface $handler
    ): ResponseInterface {
        $response = $handler->handle($request);
        return $response
            ->withHeader('Cross-Origin-Opener-Policy',
                'same-origin')
            ->withHeader('Cross-Origin-Resource-Policy',
                'same-origin')
            ->withHeader('Cross-Origin-Embedder-Policy',
                'require-corp');
    }
}