Security-Header-Architektur für Contao

<?php
// src/EventSubscriber/SecurityHeaderSubscriber.php

namespace App\EventSubscriber;

use Symfony\Component\EventDispatcher\EventSubscriberInterface;
use Symfony\Component\HttpKernel\Event\ResponseEvent;
use Symfony\Component\HttpKernel\KernelEvents;

class SecurityHeaderSubscriber implements EventSubscriberInterface {

  public static function getSubscribedEvents(): array {
    return [KernelEvents::RESPONSE => ['onResponse', 0]];
  }

  public function onResponse(ResponseEvent $event): void {
    $response = $event->getResponse();

    // Basis Security Headers
    $response->headers->set('Strict-Transport-Security',
      'max-age=31536000; includeSubDomains; preload');
    $response->headers->set('X-Content-Type-Options', 'nosniff');
    $response->headers->set('X-Frame-Options', 'SAMEORIGIN');
    $response->headers->set('Referrer-Policy',
      'strict-origin-when-cross-origin');
    $response->headers->set('Permissions-Policy',
      'camera=(), microphone=(), geolocation=()');
  }
}

# config/services.yaml — Service registrieren
services:
  App\EventSubscriber\SecurityHeaderSubscriber:
    tags: ['kernel.event_subscriber']

# public/.htaccess — Security Headers Fallback
<IfModule mod_headers.c>
  Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
  Header always set X-Content-Type-Options "nosniff"
  Header always set X-Frame-Options "SAMEORIGIN"
  Header always set Referrer-Policy "strict-origin-when-cross-origin"
  Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"
</IfModule>