src/EventSubscriber/SecurityHeadersSubscriber.php line 24

Open in your IDE?
  1. <?php
  3. declare(strict_types=1);
  5. namespace MedBrief\MSR\EventSubscriber;
  7. use MedBrief\MSR\Service\Security\HttpHeaders\ContentSecurityPolicyBuilder;
  8. use MedBrief\MSR\Service\Security\HttpHeaders\CspNonceProvider;
  9. use Symfony\Component\EventDispatcher\EventSubscriberInterface;
  10. use Symfony\Component\HttpKernel\Event\ResponseEvent;
  11. use Symfony\Component\HttpKernel\KernelEvents;
  13. final class SecurityHeadersSubscriber implements EventSubscriberInterface
  14. {
  15. public function __construct(private readonly CspNonceProvider $nonces, private readonly ContentSecurityPolicyBuilder $policy)
  16. {
  17. }
  19. public static function getSubscribedEvents(): array
  20. {
  21. return [KernelEvents::RESPONSE => [['prepareProfilerNonce', -127], ['onResponse', -1100]]];
  22. }
  24. public function prepareProfilerNonce(ResponseEvent $event): void
  25. {
  26. $headers = $event->getResponse()->headers;
  27. if (!$event->isMainRequest() || !$headers->has('X-Debug-Token')
  28. || !str_starts_with(strtolower($headers->get('Content-Type', '')), 'text/html')
  29. || $headers->has('Content-Disposition')) {
  30. return;
  31. }
  32. // Symfony's toolbar runs at -128. Give it the application's request-owned
  33. // nonce before injection; client-supplied profiler nonces are never trusted.
  34. foreach (['X-SymfonyProfiler-Script-Nonce', 'X-SymfonyProfiler-Style-Nonce'] as $header) {
  35. $event->getRequest()->headers->remove($header);
  36. $headers->set($header, $this->nonces->getNonce());
  37. }
  38. }
  40. public function onResponse(ResponseEvent $event): void
  41. {
  42. if (!$event->isMainRequest()) {
  43. return;
  44. }
  45. $response = $event->getResponse();
  46. $headers = $response->headers;
  47. if (!in_array($headers->get('Referrer-Policy'), ['no-referrer', 'same-origin', 'strict-origin'], true)) {
  48. $headers->set('Referrer-Policy', 'strict-origin-when-cross-origin');
  49. }
  50. $headers->set('Permissions-Policy', 'camera=(), microphone=(), geolocation=(), payment=(), usb=(), serial=(), hid=(), bluetooth=()');
  51. $existing = $headers->get('Content-Security-Policy', '');
  52. // Preserve the explicitly restrictive attachment policies. Other pre-existing
  53. // policies intersect with ours, so an accidental permissive one cannot bypass it.
  54. if (trim($existing) !== "default-src 'none'; object-src 'none'; script-src 'none';") {
  55. $isHtml = str_starts_with(strtolower($headers->get('Content-Type', '')), 'text/html');
  56. $headers->set('Content-Security-Policy', $isHtml
  57. ? $this->policy->build($this->nonces->getNonce())
  58. : "default-src 'none'; object-src 'none'; script-src 'none'; base-uri 'none'; frame-ancestors 'self';", false);
  59. if ($isHtml) {
  60. // A cached body must never be paired with a different response's nonce.
  61. $headers->set('Cache-Control', 'private, no-store');
  62. $headers->remove('ETag');
  63. $headers->remove('Last-Modified');
  64. $headers->remove('Expires');
  65. }
  66. }
  67. }
  68. }