src/AppBundle/EventSubscriber/CSPSubscriber.php line 12

Open in your IDE?
  1. <?php
  3. namespace AppBundle\EventSubscriber;
  5. use Symfony\Component\HttpKernel\Event\FilterResponseEvent;
  6. use Symfony\Component\HttpKernel\KernelEvents;
  7. use Symfony\Component\EventDispatcher\EventSubscriberInterface;
  9. class CSPSubscriber implements EventSubscriberInterface
  10. {
  12.     public function onKernelResponse(FilterResponseEvent $event)
  13.     {
  14.         $response = $event->getResponse();
  16.         $policy = "default-src 'self' 'unsafe-inline';"
  17.             . "script-src 'self' 'unsafe-inline' 'unsafe-eval' code.jquery.com " .
  18.             "ajax.googleapis.com maps.googleapis.com maps.gstatic.com " .
  19.             "www.googletagmanager.com www.google-analytics.com " .
  20.             "ssl.google-analytics.com www.googleadservices.com" .
  21.             "stats.g.doubleclick.net googleads.g.doubleclick.net " .
  22.             "https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ " .
  23.             "c.seznam.cz;"
  24.             . "frame-src https://www.google.com/recaptcha/ https://www.google.com/maps/ https://www.rezidencesmichovcity.cz/ https://tour.vrspace.cz/ seznam.cz;"
  25.             . "style-src 'self' 'unsafe-inline' code.jquery.com fonts.googleapis.com c.seznam.cz;"
  26.             . "font-src 'self' 'unsafe-inline' data: fonts.gstatic.com;"
  27.             . "child-src 'self' 'unsafe-inline' www.google.com tour.vrspace.cz www.rezidencesmichovcity.cz;"
  28.             . "img-src 'self' data: www.googletagmanager.com www.google-analytics.com c.imedia.cz c.seznam.cz h.seznam.cz www.google.com www.google.cz stats.g.doubleclick.net;"
  29.             . "connect-src 'self' www.google-analytics.com stats.g.doubleclick.net;";
  31.         $response->headers->set("Content-Security-Policy", $policy);
  32.         $response->headers->set("Strict-Transport-Security", "max-age=63072000");
  33.         $response->headers->set("X-Frame-Options", "DENY");
  34.         $response->headers->set("X-Content-Type-Options", "nosniff");
  35.         $response->headers->set("X-XSS-Protection", "1; mode=block");
  36.     }
  38.     public static function getSubscribedEvents()
  39.     {
  40.         return [
  41.             KernelEvents::RESPONSE => 'onKernelResponse'
  42.         ];
  43.     }
  44. }