X-Content-Type-Options in PHP konfigurieren

<?php
// security-headers.php — MIME-Sniffing verhindern

if (!headers_sent()) {
    header('X-Content-Type-Options: nosniff');
}

// Wichtig: Korrekte Content-Types setzen
// Fuer JSON-APIs:
header('Content-Type: application/json; charset=utf-8');
// Fuer Downloads:
// header('Content-Type: application/octet-stream');

; .user.ini — Auto-Prepend fuer Security Headers
; Wird vor jedem PHP-Script automatisch geladen

auto_prepend_file = "/var/www/html/security-headers.php"

; Hinweis: .user.ini wird von PHP-FPM gecached
; user_ini.cache_ttl = 300 (5 Minuten Default)
; Nach Aenderung bis zu 5 Min warten oder FPM neustarten

<?php
// src/Middleware/NosniffMiddleware.php — PSR-15

namespace App\Middleware;

use Psr\Http\Message\ResponseInterface;
use Psr\Http\Message\ServerRequestInterface;
use Psr\Http\Server\MiddlewareInterface;
use Psr\Http\Server\RequestHandlerInterface;

class NosniffMiddleware implements MiddlewareInterface
{
    public function process(
        ServerRequestInterface $request,
        RequestHandlerInterface $handler
    ): ResponseInterface {
        $response = $handler->handle($request);
        return $response->withHeader(
            'X-Content-Type-Options',
            'nosniff'
        );
    }
}