CSP in Drupal konfigurieren

# CSP-Modul installieren (empfohlen für Nonce-Support)
composer require drupal/csp
drush en csp -y
drush cr

# Konfiguration unter:
# /admin/config/system/csp
# Report-Only und Enforced getrennt konfigurierbar

# seckit CSP-Tab: /admin/config/system/seckit
# → Tab "Content Security Policy"
# Felder pro Direktive ausfüllen:

default-src: 'self'
script-src:  'self'
style-src:   'self' 'unsafe-inline'
img-src:     'self' data:
font-src:    'self'
object-src:  'none'
base-uri:    'self'
form-action: 'self'

# Checkbox: "Report Only" zuerst aktivieren!

<?php
// modules/custom/security_headers/src/EventSubscriber/CspSubscriber.php

namespace Drupal\security_headers\EventSubscriber;

use Symfony\Component\EventDispatcher\EventSubscriberInterface;
use Symfony\Component\HttpKernel\Event\ResponseEvent;
use Symfony\Component\HttpKernel\KernelEvents;

class CspSubscriber implements EventSubscriberInterface {

  public static function getSubscribedEvents() {
    return [KernelEvents::RESPONSE => ['onResponse', 0]];
  }

  public function onResponse(ResponseEvent $event) {
    $response = $event->getResponse();

    $csp = implode('; ', [
      "default-src 'self'",
      "script-src 'self'",
      "style-src 'self' 'unsafe-inline'",
      "img-src 'self' data: https:",
      "font-src 'self'",
      "object-src 'none'",
      "base-uri 'self'",
      "form-action 'self'",
      "frame-ancestors 'none'",
      "upgrade-insecure-requests",
    ]);

    // Report-Only zuerst, dann Enforcement
    $response->headers->set(
      'Content-Security-Policy-Report-Only', $csp);
  }
}