Reporting API auf Strato konfigurieren

# .htaccess — Reporting-Endpoints und Report-To
<IfModule mod_headers.c>
    # Reporting-Endpoints definieren
    Header set Reporting-Endpoints "csp-endpoint=\"https://ihre-domain.de/api/csp-report\""

    # Report-To Header (Legacy-Browsers)
    Header set Report-To "{\"group\":\"csp-endpoint\",\"max_age\":86400,\"endpoints\":[{\"url\":\"https://ihre-domain.de/api/csp-report\"}]}"
</IfModule>

// PHP — Reporting-Endpoints und Report-To setzen
<?php
header('Reporting-Endpoints: csp-endpoint="https://ihre-domain.de/api/csp-report"');
header('Report-To: {"group":"csp-endpoint","max_age":86400,"endpoints":[{"url":"https://ihre-domain.de/api/csp-report"}]}');

// CSP mit report-to Direktive
header("Content-Security-Policy: default-src 'self'; report-to csp-endpoint");
?>

// PHP — Einfacher Report-Empfaenger (report-receiver.php)
<?php
// Nur POST-Requests akzeptieren
if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
    http_response_code(405);
    exit;
}

$report = file_get_contents('php://input');
$data = json_decode($report, true);

// In Log-Datei schreiben
file_put_contents(
    __DIR__ . '/csp-reports.log',
    date('Y-m-d H:i:s') . ' ' . $report . PHP_EOL,
    FILE_APPEND | LOCK_EX
);

http_response_code(204);
?>