Common\EventListener\ResponseSecurer::onKernelResponse()

Complexity

Conditions	7
Paths	18

Size

Total Lines	40
Code Lines	26

Duplication

Lines	0
Ratio	0 %

Code Coverage

Tests	19
CRAP Score	7.0061

Importance

Changes	4
Bugs	0	Features	0

<?php
    public function onKernelResponse(FilterResponseEvent $event): void
    {
        $cacheControl = [
            'max-age=0',
            'must-revalidate',
            'private',
            'no-cache',
        ];

        if (defined('APPLICATION') && APPLICATION === 'Backend') {

The condition Common\EventListener\APPLICATION === 'Backend' is always false.

            $cacheControl[] = 'no-store';
        }

        $headers = [
            'Cache-Control' => implode(', ', $cacheControl),
            'X-Frame-Options' => 'deny',
            'Expires' =>  '0',
            'Pragma' => 'no-cache',
            'referrer' => 'strict-origin-when-cross-origin',
            'Referrer-Policy' => 'strict-origin-when-cross-origin',
            'X-XSS-Protection' => '1; mode=block',
            'X-Content-Type-Options' => 'nosniff',
        ];


        $responseHeaders = $event->getResponse()->headers;
        foreach ($headers as $header => $value) {
            if (!$responseHeaders->has($header)) {
                $responseHeaders->set($header, $value);
            }
        }

        // Don't leak server config
        $blockedHeaders = [
            'x-powered-by',
            'Server',
        ];
        foreach ($blockedHeaders as $blockedHeader) {
            if ($responseHeaders->has($blockedHeader)) {
                $responseHeaders->remove($blockedHeader);
            }