function FinishResponseSubscriber::onRespond

Sets extra headers on successful responses.

Parameters

\Symfony\Component\HttpKernel\Event\FilterResponseEvent $event: The event to process.

File

core/lib/Drupal/Core/EventSubscriber/FinishResponseSubscriber.php, line 112

Class

FinishResponseSubscriber

Response subscriber to handle finished responses.

Namespace

Code

public function onRespond(FilterResponseEvent $event) {
    if (!$event->isMasterRequest()) {
        return;
    }
    $request = $event->getRequest();
    $response = $event->getResponse();
    // Set the X-UA-Compatible HTTP header to force IE to use the most recent
    // rendering engine.
    $response->headers
        ->set('X-UA-Compatible', 'IE=edge', FALSE);
    // Set the Content-language header.
    $response->headers
        ->set('Content-language', $this->languageManager
        ->getCurrentLanguage()
        ->getId());
    // Prevent browsers from sniffing a response and picking a MIME type
    // different from the declared content-type, since that can lead to
    // XSS and other vulnerabilities.
    // https://www.owasp.org/index.php/List_of_useful_HTTP_headers
    $response->headers
        ->set('X-Content-Type-Options', 'nosniff', FALSE);
    $response->headers
        ->set('X-Frame-Options', 'SAMEORIGIN', FALSE);
    // If the current response isn't an implementation of the
    // CacheableResponseInterface, we assume that a Response is either
    // explicitly not cacheable or that caching headers are already set in
    // another place.
    if (!$response instanceof CacheableResponseInterface) {
        if (!$this->isCacheControlCustomized($response)) {
            $this->setResponseNotCacheable($response, $request);
        }
        // HTTP/1.0 proxies do not support the Vary header, so prevent any caching
        // by sending an Expires date in the past. HTTP/1.1 clients ignore the
        // Expires header if a Cache-Control: max-age directive is specified (see
        // RFC 2616, section 14.9.3).
        if (!$response->headers
            ->has('Expires')) {
            $this->setExpiresNoCache($response);
        }
        return;
    }
    if ($this->debugCacheabilityHeaders) {
        // Expose the cache contexts and cache tags associated with this page in a
        // X-Drupal-Cache-Contexts and X-Drupal-Cache-Tags header respectively.
        $response_cacheability = $response->getCacheableMetadata();
        $response->headers
            ->set('X-Drupal-Cache-Tags', implode(' ', $response_cacheability->getCacheTags()));
        $response->headers
            ->set('X-Drupal-Cache-Contexts', implode(' ', $this->cacheContextsManager
            ->optimizeTokens($response_cacheability->getCacheContexts())));
    }
    $is_cacheable = $this->requestPolicy
        ->check($request) === RequestPolicyInterface::ALLOW && $this->responsePolicy
        ->check($response, $request) !== ResponsePolicyInterface::DENY;
    // Add headers necessary to specify whether the response should be cached by
    // proxies and/or the browser.
    if ($is_cacheable && $this->config
        ->get('cache.page.max_age') > 0) {
        if (!$this->isCacheControlCustomized($response)) {
            // Only add the default Cache-Control header if the controller did not
            // specify one on the response.
            $this->setResponseCacheable($response, $request);
        }
    }
    else {
        // If either the policy forbids caching or the sites configuration does
        // not allow to add a max-age directive, then enforce a Cache-Control
        // header declaring the response as not cacheable.
        $this->setResponseNotCacheable($response, $request);
    }
}