ClickjackProtectionSubscriber   A
last analyzed

Complexity

Total Complexity 4

Size/Duplication

Total Lines 26
Duplicated Lines 0 %

Importance

Changes 0
Metric Value
eloc 8
dl 0
loc 26
rs 10
c 0
b 0
f 0
wmc 4

3 Methods

Rating   Name   Duplication   Size   Complexity  
A __construct() 0 2 1
A getSubscribedEvents() 0 4 1
A onKernelResponse() 0 10 2
1
<?php
2
3
declare(strict_types=1);
4
5
/*
6
 * This file is part of the Zikula package.
7
 *
8
 * Copyright Zikula - https://ziku.la/
9
 *
10
 * For the full copyright and license information, please view the LICENSE
11
 * file that was distributed with this source code.
12
 */
13
14
namespace Zikula\CoreBundle\EventSubscriber;
15
16
use Symfony\Component\EventDispatcher\EventSubscriberInterface;
17
use Symfony\Component\HttpKernel\Event\ResponseEvent;
18
use Symfony\Component\HttpKernel\KernelEvents;
19
20
/**
21
 * Sets x-origin headers to prevent clickjacking attacks.
22
 *
23
 * Consider https://github.com/nelmio/NelmioSecurityBundle for a future major release refs #3646
24
 */
25
class ClickjackProtectionSubscriber implements EventSubscriberInterface
26
{
27
    public function __construct(private readonly string $xFrameOptions)
28
    {
29
    }
30
31
    public static function getSubscribedEvents(): array
32
    {
33
        return [
34
            KernelEvents::RESPONSE => ['onKernelResponse', -99],
35
        ];
36
    }
37
38
    /**
39
     * Sets x-origin headers in the response object.
40
     */
41
    public function onKernelResponse(ResponseEvent $event): void
42
    {
43
        if (!$event->isMainRequest()) {
44
            return;
45
        }
46
47
        $response = $event->getResponse();
48
49
        $response->headers->set('X-Frame-Options', $this->xFrameOptions);
50
        $response->headers->set('X-XSS-Protection', '1');
51
    }
52
}
53