Add support for CSP headers

Thanks a lot for your work with this issue @jorgik!

Could you please try to change your indenting so it would follow Drupal coding standards https://www.drupal.org/docs/develop/standards/php/php-coding-standards#i... ?

It seems there's now a lot of 4 space indenting instead of 2 spaces which makes looking at the changes a little difficult.

There's also a couple of occasions with issues like "Access to constant POLICY_ALTER on an unknown class Drupal\csp\CspEvents."

Based on the great work by @jorgik, I updated the code to the latest version and fixed all remaining code quality issues. I also made a few small refactors to leverage existing services from the CSP module and added some tests.

Hope this helps! Looking forward to a review!

Hello @lakdev and thanks a lot for your efforts with these features!

I tested your code and as far as I could find out the nonce seems to work. I also liked a lot of that implementation where enabling the CSP mode requires a separate install of the CSP module instead of adding that module anyway. So it leaves it up to the admins to make the choice if they want to have the module or not. That's a good idea!

However, I picked up 5 deprecation warnings with phpunit testing. At least some of these seem quite simple to fix, but can you still give a look at these yourself too?

1) /var/www/html/vendor/symfony/error-handler/DebugClassLoader.php:347
Method "Symfony\Component\EventDispatcher\EventSubscriberInterface::getSubscribedEvents()" might add "array" as a native return type declaration in the future. Do the same in implementation "Drupal\piwik_pro\EventSubscriber\PiwikProCspAlterSubscriber" now to avoid errors or add an explicit @return annotation to suppress this message.

Triggered by:

* Drupal\Tests\piwik_pro\Functional\PiwikProCspIntegrationTest::testCspHeaderWithNonContainersDomain
  /var/www/html/web/modules/contrib/piwik_pro/tests/src/Functional/PiwikProCspIntegrationTest.php:370

2) /var/www/html/web/core/lib/Drupal/Core/Plugin/DefaultPluginManager.php:169
Not supporting attribute discovery in Drupal\Core\Plugin\DefaultPluginManager is deprecated in drupal:11.2.0 and is removed from drupal:12.0.0. Provide an Attribute class and an Annotation class for BC. See https://www.drupal.org/node/3395582

Triggered by:

* Drupal\Tests\piwik_pro\Functional\PiwikProCspIntegrationTest::testCspHeaderWithNonContainersDomain
  /var/www/html/web/modules/contrib/piwik_pro/tests/src/Functional/PiwikProCspIntegrationTest.php:370

3) /var/www/html/web/core/lib/Drupal/Core/Test/HttpClientMiddleware/TestHttpClientMiddleware.php:52
The core/js-cookie asset library is deprecated in Drupal 10.1.0 and will be removed in Drupal 11.0.0. There is no replacement. See https://www.drupal.org/node/3322720

Triggered by:

* Drupal\Tests\piwik_pro\Functional\PiwikProCspIntegrationTest::testCspHeaderWithNonContainersDomain
  /var/www/html/web/modules/contrib/piwik_pro/tests/src/Functional/PiwikProCspIntegrationTest.php:370

4) /var/www/html/web/core/lib/Drupal/Core/Test/HttpClientMiddleware/TestHttpClientMiddleware.php:52
Not supporting attribute discovery in Drupal\Core\Plugin\DefaultPluginManager is deprecated in drupal:11.2.0 and is removed from drupal:12.0.0. Provide an Attribute class and an Annotation class for BC. See https://www.drupal.org/node/3395582

Triggered by:

* Drupal\Tests\piwik_pro\Functional\PiwikProCspIntegrationTest::testCspHeaderWithNonContainersDomain (5 times)
  /var/www/html/web/modules/contrib/piwik_pro/tests/src/Functional/PiwikProCspIntegrationTest.php:370

5) /var/www/html/web/core/lib/Drupal/Core/Asset/LibraryDiscoveryCollector.php:179
The core/js-cookie asset library is deprecated in Drupal 10.1.0 and will be removed in Drupal 11.0.0. There is no replacement. See https://www.drupal.org/node/3322720

Triggered by:

* Drupal\Tests\piwik_pro\Functional\PiwikProCspIntegrationTest::testCspHeaderWithoutPiwikProConfiguration
  /var/www/html/web/modules/contrib/piwik_pro/tests/src/Functional/PiwikProCspIntegrationTest.php:227

The first one could be fixed by just changing this:
public static function getSubscribedEvents() {
to this
public static function getSubscribedEvents(): array {
in piwik_pro/src/EventSubscriber/PiwikProCspAlterSubscriber.php

Hi @hartsak,

Thanks for testing and your feedback! I fixed the first issue though I'm not sure whether the other ones are related to any of my code since I'm not really using those classes.

I'm running PHPUnit via DDEV Contrib - Can you maybe also explain how to see those deprecations since I'm not getting them by default?

Hello again @lakdev!

Thank you for fixing those warnings. I think we can ignore those other ones I mentioned about if you didn't see them in your own local.

I'll mark this as RTBC and let's get this merged soonish!

This is now merged and added as a new release 1.4.3

Thanks a lot for all contributors especially @jorgik and @lakdev!

I enabled this setting on a site, and got a 500 error when viewing the site in anonymous mode. As logged in user it is working fijn. No error shows up in the drupal logs, but in the apache logs I see " Premature end of script headers: index.php". So I think something is not working correctly. I'll look into it if I can find the cause of the error.

Hm, might be problem that the csp-headers make the header too big.

Confirmed that our header got too big, so I put this ticket back to fixed.