Permissions Policy in Drupal konfigurieren

# seckit: /admin/config/system/seckit → Tab "Various"
# Feature-Policy / Permissions-Policy Feld:
camera=(), microphone=(), geolocation=(), payment=(), usb=(), magnetometer=(), gyroscope=(), accelerometer=()

<?php
// modules/custom/security_headers/src/EventSubscriber/PermissionsPolicySubscriber.php

namespace Drupal\security_headers\EventSubscriber;

use Symfony\Component\EventDispatcher\EventSubscriberInterface;
use Symfony\Component\HttpKernel\Event\ResponseEvent;
use Symfony\Component\HttpKernel\KernelEvents;

class PermissionsPolicySubscriber implements EventSubscriberInterface {

  public static function getSubscribedEvents() {
    return [KernelEvents::RESPONSE => ['onResponse', 0]];
  }

  public function onResponse(ResponseEvent $event) {
    $response = $event->getResponse();
    $response->headers->set('Permissions-Policy',
      'camera=(), microphone=(), geolocation=(), payment=(), usb=(), magnetometer=(), gyroscope=(), accelerometer=()'
    );
  }
}

# .htaccess — Permissions-Policy
<IfModule mod_headers.c>
  Header always set Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=(), usb=()"
</IfModule>