Security-Header-Architektur für Shopware 6

# config/packages/shopware.yaml — CSP-Konfiguration
shopware:
    security:
        csp_templates:
            # Standard für alle Kontexte
            default:
                default-src: "'self'"
                script-src: "'self' '%nonce%' 'strict-dynamic'"
                style-src: "'self' 'unsafe-inline'"
                img-src: "'self' data: https:"
                font-src: "'self'"
                object-src: "'none'"
                base-uri: "'self'"
            # Storefront — mit Payment-Providern
            storefront:
                script-src: "'self' '%nonce%' *.paypal.com js.stripe.com *.klarna.com"
                frame-src: "'self' *.paypal.com *.stripe.com *.klarna.com"
                connect-src: "'self' *.paypal.com *.stripe.com *.klarna.com"
            # Administration — großzügiger
            administration:
                script-src: "'self' 'unsafe-eval' 'unsafe-inline'"
                style-src: "'self' 'unsafe-inline'"

<?php
// custom/plugins/SecurityHeaders/src/Subscriber/SecurityHeaderSubscriber.php

namespace SecurityHeaders\Subscriber;

use Symfony\Component\EventDispatcher\EventSubscriberInterface;
use Symfony\Component\HttpKernel\Event\ResponseEvent;
use Symfony\Component\HttpKernel\KernelEvents;

class SecurityHeaderSubscriber implements EventSubscriberInterface
{
    public static function getSubscribedEvents(): array
    {
        return [
            KernelEvents::RESPONSE => ['onResponse', -256],
        ];
    }

    public function onResponse(ResponseEvent $event): void
    {
        if (!$event->isMainRequest()) {
            return;
        }

        $response = $event->getResponse();

        // HSTS — nur über HTTPS senden
        $response->headers->set(
            'Strict-Transport-Security',
            'max-age=31536000; includeSubDomains; preload'
        );

        // Basis-Header
        $response->headers->set('X-Content-Type-Options', 'nosniff');
        $response->headers->set('Referrer-Policy', 'strict-origin-when-cross-origin');
        $response->headers->set('X-Frame-Options', 'SAMEORIGIN');
        $response->headers->set('Permissions-Policy',
            'camera=(), microphone=(), geolocation=()');

        // Cross-Origin Headers
        $response->headers->set('Cross-Origin-Opener-Policy', 'same-origin');
        $response->headers->set('Cross-Origin-Resource-Policy', 'same-origin');
        $response->headers->set('Origin-Agent-Cluster', '?1');
    }
}

<!-- custom/plugins/SecurityHeaders/src/Resources/config/services.xml -->
<?xml version="1.0" ?>
<container xmlns="http://symfony.com/schema/dic/services">
    <services>
        <service id="SecurityHeaders\Subscriber\SecurityHeaderSubscriber">
            <tag name="kernel.event_subscriber"/>
        </service>
    </services>
</container>