Reporting API in PHP konfigurieren

<?php
// security-headers.php — Reporting API

if (!headers_sent()) {
    // Reporting-Endpoints definieren
    header('Reporting-Endpoints: csp-endpoint="https://ihre-domain.de/api/csp-report", default="https://ihre-domain.de/api/reports"');

    // CSP mit report-to Direktive
    header("Content-Security-Policy: default-src 'self'; report-to csp-endpoint");

    // Weitere Header mit report-to:
    // Cross-Origin-Opener-Policy: same-origin; report-to=default
}

; .user.ini — Auto-Prepend für Reporting API

auto_prepend_file = "/var/www/html/security-headers.php"

; Die security-headers.php setzt Reporting-Endpoints
; global für alle PHP-Dateien.
; PHP-FPM Cache-TTL: 5 Minuten
; Nach Änderung: systemctl restart php-fpm

<?php
// api/csp-report.php — Report-Empfänger

header('Content-Type: application/json');

if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
    http_response_code(405);
    exit;
}

$body = file_get_contents('php://input');
$reports = json_decode($body, true);

if (!$reports) {
    http_response_code(400);
    exit;
}

// Reports loggen oder in Datenbank speichern
foreach ($reports as $report) {
    error_log(json_encode($report));
}

http_response_code(204);