如何使用 .htaccess 将 X-XSS-Protection 和 X-Frame-Option 添加到 PHP 中的响应 Header

Question

我想通过添加反跨站点脚本 (XSS) 安全措施来提高我网站的安全性。

我正在尝试在我的 .htaccess 文件中设置 headers 以包含所需的 headers 以防止 XSS 和点击劫持。

但是当我添加 headers 时，当我检查我网站的网络选项卡时，它们并没有反映在我的网站中。

我还尝试将 headers 添加到我的 header.php 文件中，该文件已包含在我网站的所有 .php 文件中，但 headers 是已发送未发送或未显示在网络选项卡中。

这是我的代码：

.htaccess 文件：

RewriteEngine  on
RewriteCond %{REQUEST_FILENAME}.php -f
RewriteCond %{REQUEST_URI} !^/\.well-known/cpanel-dcv/[0-9a-zA-Z_-]+$
RewriteCond %{REQUEST_URI} !^/\.well-known/pki-validation/(?:\ Ballot169)?
RewriteCond %{REQUEST_URI} !^/\.well-known/pki-validation/[A-F0-9]{32}\.txt(?:\ Comodo\ DCV)?$
RewriteRule !.*\.php$ %{REQUEST_FILENAME}.php [QSA,L]


RewriteEngine On
RewriteCond %{HTTPS} off
RewriteCond %{REQUEST_URI} !^/\.well-known/cpanel-dcv/[0-9a-zA-Z_-]+$
RewriteCond %{REQUEST_URI} !^/\.well-known/pki-validation/(?:\ Ballot169)?
RewriteCond %{REQUEST_URI} !^/\.well-known/pki-validation/[A-F0-9]{32}\.txt(?:\ Comodo\ DCV)?$
RewriteCond %{SERVER_PORT} 80

    


RewriteRule (.*) https://%{SERVER_NAME}/ [R,L]
Options -Indexes
    Header set X-XSS-Protection "1; mode=block"
    Header append X-Frame-Options: "SAMEORIGIN"
    Header set X-Content-Type-Options nosniff
    
# BEGIN cPanel-generated php ini directives, do not edit
# Manual editing of this file may result in unexpected behavior.
# To make changes to this file, use the cPanel MultiPHP INI Editor (Home >> Software >> MultiPHP INI Editor)
# For more information, read our documentation (https://go.cpanel.net/EA4ModifyINI)
<IfModule php7_module>
   php_flag display_errors Off
   php_value max_execution_time 60
   php_value max_input_time 60
   php_value max_input_vars 1000
   php_value memory_limit 256M
   php_value post_max_size 32M
   php_value session.gc_maxlifetime 1440
   php_value session.save_path "/var/cpanel/php/sessions/ea-php70"
   php_value upload_max_filesize 64M
   php_flag zlib.output_compression Off
</IfModule>
<IfModule lsapi_module>
   php_flag display_errors Off
   php_value max_execution_time 60
   php_value max_input_time 60
   php_value max_input_vars 1000
   php_value memory_limit 256M
   php_value post_max_size 32M
   php_value session.gc_maxlifetime 1440
   php_value session.save_path "/var/cpanel/php/sessions/ea-php70"
   php_value upload_max_filesize 64M
   php_flag zlib.output_compression Off
</IfModule>
# END cPanel-generated php ini directives, do not edit

### If mod_rewrite is true...
<IfModule mod_rewrite.c>
    Header set X-XSS-Protection "1; mode=block"
    Header always append X-Frame-Options SAMEORIGIN
    Header set X-Content-Type-Options nosniff
### Prevent Apache from showing its server signature...
ServerSignature off
### Prevent phpinfo from showing details...
RewriteCond %{QUERY_STRING} =PHP[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12} [NC] 
RewriteRule .* - [F]

</IfModule>

# X-XSS-Protection
<IfModule mod_headers.c>
    Header set X-XSS-Protection "1; mode=block"
    Header always append X-Frame-Options SAMEORIGIN
    Header set X-Content-Type-Options nosniff
</IfModule>

# php -- BEGIN cPanel-generated handler, do not edit
# Set the “ea-php70” package as the default “PHP” programming language.
<IfModule mime_module>
  AddHandler application/x-httpd-ea-php70 .php .php7 .phtml
</IfModule>
# php -- END cPanel-generated handler, do not edit

header.php 文件:

<?php
 // I included these headers at the top of my header.php file that is included everywhere in my website files.
 header("X-XSS-Protection: 1; mode=block");
 header("X-Frame-Options: SAMEORIGIN");
?>

Answer 1

我发现问题出在 headers are already being sent 错误，解决方法是删除 php 标签开头的白色 space文件。

导致错误的先前代码：

 <?php
   //my code
 ?>

删除白色space 解决了问题：

<?php
       //my code
     ?>

如何使用 .htaccess 将 X-XSS-Protection 和 X-Frame-Option 添加到 PHP 中的响应 Header

How To Add X-XSS-Protection and X-Frame-Option to Response Header in PHP using .htaccess

php

security

xss

.htaccess

clickjacking