Subresource Integrity (SRI) in PHP konfigurieren

<?php
// helpers/sri.php — SRI-Hash generieren

// Variante A: Hash fuer lokale Datei berechnen
$hash = base64_encode(hash_file('sha384', './assets/vendor.js', true));
$integrity = 'sha384-' . $hash;

// Variante B: Hash fuer Remote-Ressource
$content = file_get_contents('https://cdn.example.com/lib.js');
$remoteHash = 'sha384-' . base64_encode(hash('sha384', $content, true));

// Im HTML-Template:
// <script src="https://cdn.example.com/lib.js"
//   integrity="<?= htmlspecialchars($integrity) ?>"
//   crossorigin="anonymous"></script>

<?php
// helpers/SriHelper.php — Wiederverwendbare SRI-Klasse

class SriHelper
{
    private static array $cache = [];

    public static function hash(string $filePath): string
    {
        if (isset(self::$cache[$filePath])) {
            return self::$cache[$filePath];
        }

        if (!file_exists($filePath)) {
            throw new \RuntimeException(
                "SRI: Datei nicht gefunden: $filePath"
            );
        }

        $hash = 'sha384-' . base64_encode(
            hash_file('sha384', $filePath, true)
        );

        self::$cache[$filePath] = $hash;
        return $hash;
    }

    public static function script(
        string $src, string $localPath
    ): string {
        $integrity = self::hash($localPath);
        return sprintf(
            '<script src="%s" integrity="%s" crossorigin="anonymous"></script>',
            htmlspecialchars($src),
            htmlspecialchars($integrity)
        );
    }
}

<?php
// Middleware/SriMiddleware.php — PSR-15
// Injiziert SRI-Hashes in HTML-Responses

namespace App\Middleware;

use Psr\Http\Message\ResponseInterface;
use Psr\Http\Server\MiddlewareInterface;

class SriMiddleware implements MiddlewareInterface
{
    private array $manifest;

    public function __construct(string $manifestPath)
    {
        // sri-manifest.json vom Build-Prozess laden
        $this->manifest = json_decode(
            file_get_contents($manifestPath), true
        );
    }
}