Security-Header-Architektur für Drupal

# seckit per Composer installieren
composer require drupal/seckit
drush en seckit -y
drush cr

# Konfiguration unter:
# /admin/config/system/seckit
# Tabs: CSP | HSTS | Clickjacking | Various

<?php
// modules/custom/security_headers/src/EventSubscriber/SecurityHeadersSubscriber.php

namespace Drupal\security_headers\EventSubscriber;

use Symfony\Component\EventDispatcher\EventSubscriberInterface;
use Symfony\Component\HttpKernel\Event\ResponseEvent;
use Symfony\Component\HttpKernel\KernelEvents;

class SecurityHeadersSubscriber implements EventSubscriberInterface {

  public static function getSubscribedEvents() {
    // Priorität > 0 damit nach seckit
    return [KernelEvents::RESPONSE => ['onResponse', -10]];
  }

  public function onResponse(ResponseEvent $event) {
    $response = $event->getResponse();

    // Header die seckit NICHT abdeckt
    $response->headers->set('Cross-Origin-Opener-Policy', 'same-origin');
    $response->headers->set('Cross-Origin-Resource-Policy', 'same-origin');
    $response->headers->set('Cross-Origin-Embedder-Policy', 'require-corp');
    $response->headers->set('Origin-Agent-Cluster', '?1');
    $response->headers->set('X-DNS-Prefetch-Control', 'off');
  }
}

# modules/custom/security_headers/security_headers.services.yml
services:
  security_headers.response_subscriber:
    class: Drupal\security_headers\EventSubscriber\SecurityHeadersSubscriber
    tags:
      - { name: event_subscriber }

# .htaccess (im Drupal-Root, VOR dem RewriteEngine Block)
# ACHTUNG: Drupal Core-Updates überschreiben die .htaccess!
<IfModule mod_headers.c>
  Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
  Header always set X-Content-Type-Options "nosniff"
  Header always set X-Frame-Options "SAMEORIGIN"
  Header always set Referrer-Policy "strict-origin-when-cross-origin"
  Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"
  Header always set Cross-Origin-Opener-Policy "same-origin"
</IfModule>