vendor/opctim/symfony-csp-bundle/src/EventSubscriber/CspHeaderEventSubscriber.php line 53

Open in your IDE?
  1. <?php
  2. declare(strict_types=1);
  4. namespace Opctim\CspBundle\EventSubscriber;
  6. use Opctim\CspBundle\Event\AddCspHeaderEvent;
  7. use Opctim\CspBundle\Service\CspHeaderBuilderService;
  8. use Symfony\Component\EventDispatcher\EventDispatcherInterface;
  9. use Symfony\Component\EventDispatcher\EventSubscriberInterface;
  10. use Symfony\Component\HttpKernel\Event\RequestEvent;
  11. use Symfony\Component\HttpKernel\Event\ResponseEvent;
  12. use Symfony\Component\HttpKernel\KernelEvents;
  14. class CspHeaderEventSubscriber implements EventSubscriberInterface
  15. {
  16.     private string $cspHeader = '';
  17.     private EventDispatcherInterface $eventDispatcher;
  18.     private CspHeaderBuilderService $headerBuilderService;
  21.     public function __construct(
  22.         CspHeaderBuilderService  $headerBuilderService,
  23.         EventDispatcherInterface $eventDispatcher
  24.     )
  25.     {
  26.         $this->headerBuilderService = $headerBuilderService;
  27.         $this->eventDispatcher = $eventDispatcher;
  28.     }
  30.     public static function getSubscribedEvents(): array
  31.     {
  32.         return [
  33.             KernelEvents::REQUEST => 'onKernelRequest',
  34.             KernelEvents::RESPONSE => 'onKernelResponse'
  35.         ];
  36.     }
  38.     public function onKernelRequest(RequestEvent $event): void
  39.     {
  40.         $addCspHeaderEvent = new AddCspHeaderEvent($event->getRequest());
  42.         $this->eventDispatcher->dispatch($addCspHeaderEvent, AddCspHeaderEvent::NAME);
  44.         if ($addCspHeaderEvent->isModified()) {
  45.             $this->cspHeader = $addCspHeaderEvent->getCspHeaderValue();
  47.             return;
  48.         }
  50.         $this->cspHeader = $this->headerBuilderService->build();
  51.     }
  53.     public function onKernelResponse(ResponseEvent $event): void
  54.     {
  55.         $headerKeys = [
  56.             'Content-Security-Policy',
  57.             'X-Content-Security-Policy',
  58.             'X-WebKit-CSP'
  59.         ];
  61.         $response = $event->getResponse();
  62.         $reportingEndpointHeader = $this->headerBuilderService->buildReportingEndpointsHeader();
  64.         if ($reportingEndpointHeader) {
  65.             $response->headers->set('Reporting-Endpoint', $reportingEndpointHeader);
  66.         }
  68.         foreach ($headerKeys as $headerKey) {
  69.             $response->headers->set($headerKey, $this->cspHeader);
  70.         }
  71.     }
  72. }