Clickjacking-Schutz für Shopware 6

// SecurityHeaderSubscriber.php — X-Frame-Options
public function onResponse(ResponseEvent $event): void
{
    $response = $event->getResponse();
    $request = $event->getRequest();

    // Administration: Kein Embedding erlaubt
    if (str_starts_with($request->getPathInfo(), '/admin')) {
        $response->headers->set('X-Frame-Options', 'DENY');
        return;
    }

    // Storefront: Nur Same-Origin Embedding
    $response->headers->set('X-Frame-Options', 'SAMEORIGIN');
}

# config/packages/shopware.yaml — frame-ancestors (moderner Ersatz)
shopware:
    security:
        csp_templates:
            default:
                frame-ancestors: "'none'"
            storefront:
                frame-ancestors: "'self'"
            administration:
                frame-ancestors: "'none'"