CSP in Contao konfigurieren

# Contao Backend → Website Root → Content-Security-Policy
# (verfügbar ab Contao 5.3)

Report-Only Modus: Aktiviert

default-src: 'self'
script-src:  'self' 'nonce-auto'
style-src:   'self' 'unsafe-inline'
img-src:     'self' data: https:
font-src:    'self'
object-src:  'none'
base-uri:    'self'
form-action: 'self'
frame-ancestors: 'none'

{# Twig-Template: Nonce für Inline-Scripts #}
<script nonce="{{ csp_nonce('script-src') }}">
  // Ihr Inline-Script hier
  console.log('CSP-konform mit Nonce');
</script>

{# Externe Quelle programmatisch hinzufügen #}
{% do csp_source('script-src', 'https://cdn.example.com') %}
{% do csp_source('style-src', 'https://fonts.googleapis.com') %}

<?php
// src/EventSubscriber/CspConfigSubscriber.php
// CspHandler für programmatische CSP-Konfiguration

namespace App\EventSubscriber;

use Contao\CoreBundle\Csp\CspHandler;
use Symfony\Component\EventDispatcher\EventSubscriberInterface;
use Symfony\Component\HttpKernel\Event\ResponseEvent;
use Symfony\Component\HttpKernel\KernelEvents;

class CspConfigSubscriber implements EventSubscriberInterface {

  public function __construct(
    private readonly CspHandler $cspHandler,
  ) {}

  public static function getSubscribedEvents(): array {
    return [KernelEvents::RESPONSE => ['onResponse', 0]];
  }

  public function onResponse(ResponseEvent $event): void {
    // Externe Quellen programmatisch freigeben
    $this->cspHandler->addSource('script-src',
      'https://cdn.example.com');
    $this->cspHandler->addSource('style-src',
      'https://fonts.googleapis.com');
  }
}

# public/.htaccess — CSP-Fallback (ohne Nonce-Support)
<IfModule mod_headers.c>
  Header always set Content-Security-Policy-Report-Only "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'"
</IfModule>