custom/plugins/CampitSecurityHeaders/src/Subscriber/Core/AddSecurityHeaders.php line 33

Open in your IDE?
  1. <?php
  3. declare(strict_types=1);
  5. namespace Campit\SecurityHeaders\Subscriber\Core;
  7. use Campit\SecurityHeaders\Rule\IsValidResponseInterface;
  8. use Campit\SecurityHeaders\Service\ConfigReader;
  9. use Symfony\Component\EventDispatcher\EventSubscriberInterface;
  10. use Symfony\Component\HttpKernel\Event\ResponseEvent;
  11. use Symfony\Component\HttpKernel\KernelEvents;
  13. class AddSecurityHeaders implements EventSubscriberInterface
  14. {
  15.     private ConfigReader $configReader;
  16.     private IsValidResponseInterface $isValidResponse;
  18.     public function __construct(
  19.         ConfigReader $configReader,
  20.         IsValidResponseInterface $isValidResponse
  21.     ) {
  22.         $this->configReader = $configReader;
  23.         $this->isValidResponse = $isValidResponse;
  24.     }
  26.     public static function getSubscribedEvents(): array
  27.     {
  28.         return [
  29.             KernelEvents::RESPONSE => 'setSecurityHeaders',
  30.         ];
  31.     }
  33.     public function setSecurityHeaders(ResponseEvent $event): void
  34.     {
  35.         if (!($this->isValidResponse)($event)) {
  36.             return;
  37.         }
  39.         $response = $event->getResponse();
  40.         $context = $response->getContext();
  42.         $contentSecurityPolicyHeader = $this->configReader->contentSecurityPolicyHeader($context->getSalesChannelId());
  43.         if ($contentSecurityPolicyHeader) {
  44.             $response->headers->set('Content-Security-Policy', $contentSecurityPolicyHeader);
  45.         }
  47.         $contentSecurityPolicyReportOnlyHeader = $this->configReader->contentSecurityPolicyReportOnlyHeader($context->getSalesChannelId());
  48.         if ($contentSecurityPolicyReportOnlyHeader) {
  49.             $response->headers->set('Content-Security-Policy-Report-Only', $contentSecurityPolicyReportOnlyHeader);
  50.         }
  52.         $permissionPolicyHeader = $this->configReader->permissionPolicyHeader($context->getSalesChannelId());
  53.         if ($permissionPolicyHeader) {
  54.             $response->headers->set('Permissions-Policy', $permissionPolicyHeader);
  55.         }
  56.     }
  57. }