Referrer-Policy in Contao konfigurieren

<?php
// src/EventSubscriber/ReferrerPolicySubscriber.php
namespace App\EventSubscriber;

use Symfony\Component\EventDispatcher\EventSubscriberInterface;
use Symfony\Component\HttpKernel\Event\ResponseEvent;
use Symfony\Component\HttpKernel\KernelEvents;

class ReferrerPolicySubscriber implements EventSubscriberInterface {
  public static function getSubscribedEvents(): array {
    // Priorität -10: nach Contao-Core, vor Extension-Subscribern
    return [KernelEvents::RESPONSE => ['onResponse', -10]];
  }

  public function onResponse(ResponseEvent $event): void {
    if (!$event->isMainRequest()) {
      return;
    }

    $response = $event->getResponse();
    $response->headers->set(
      'Referrer-Policy',
      'strict-origin-when-cross-origin'
    );
  }
}

# public/.htaccess — Referrer-Policy
<IfModule mod_headers.c>
  Header always set Referrer-Policy "strict-origin-when-cross-origin"
</IfModule>

# Werte-Optionen (von streng nach liberal):
# no-referrer                      — kein Referrer (bricht Affiliate-Links)
# strict-origin-when-cross-origin  — empfohlen (guter Kompromiss)
# same-origin                      — Referrer nur bei Same-Origin
# no-referrer-when-downgrade       — Browser-Default