Reporting API für Shopware 6

// SecurityHeaderSubscriber.php — Reporting API
public function onResponse(ResponseEvent $event): void
{
    $response = $event->getResponse();

    // Reporting-Endpoints Header (neue API, Chrome 96+)
    $response->headers->set(
        'Reporting-Endpoints',
        'csp-endpoint="https://ihr-shop.de/api/csp-report", '
        . 'default="https://ihr-shop.de/api/reports"'
    );

    // Report-To Header (ältere API, Fallback für Firefox)
    $reportTo = json_encode([
        'group' => 'csp-endpoint',
        'max_age' => 86400,
        'endpoints' => [
            ['url' => 'https://ihr-shop.de/api/csp-report'],
        ],
    ]);
    $response->headers->set('Report-To', $reportTo);
}

# config/packages/shopware.yaml — CSP mit Reporting
shopware:
    security:
        csp_templates:
            storefront:
                # Neue API: report-to Direktive
                report-to: "csp-endpoint"
                # Ältere API: report-uri (Fallback)
                report-uri: "https://ihr-shop.de/api/csp-report"

            # Auch für Administration und Store-API
            administration:
                report-to: "csp-endpoint"
                report-uri: "https://ihr-shop.de/api/csp-report"

// Report-Collector: Einfacher Endpoint in einem Custom Plugin
// src/Controller/ReportCollectorController.php

use Symfony\Component\HttpFoundation\JsonResponse;
use Symfony\Component\HttpFoundation\Request;
use Symfony\Component\Routing\Annotation\Route;
use Psr\Log\LoggerInterface;

#[Route(defaults: ['_routeScope' => ['api']])]
class ReportCollectorController
{
    public function __construct(
        private readonly LoggerInterface $logger
    ) {}

    #[Route('/api/csp-report', methods: ['POST'])]
    public function collect(Request $request): JsonResponse
    {
        $report = json_decode($request->getContent(), true);

        // Bekannte Violations filtern (Payment-Provider)
        if ($this->isKnownViolation($report)) {
            return new JsonResponse(['status' => 'filtered']);
        }

        $this->logger->warning('CSP Violation', [
            'report' => $report,
        ]);

        return new JsonResponse(['status' => 'received']);
    }
}