如何使用 .htaccess 在 PHP 中将 X-XSS-Protection 和 X-Frame-Option 添加到响应标头

Question

我想通过添加反跨站脚本 (XSS) 安全措施来为我的网站增加更多安全性。

我正在尝试在我的 .htaccess 文件中设置标题以包含所需的标题以防止 XSS 和点击劫持。

但是当我添加标题时，当我检查我网站中的网络选项卡时，它们不会反映在我的网站中。

我还尝试将标题添加到我的 header.php 文件中，该文件已包含在我网站的所有 .php 文件中，但发送的标题并未发送或显示在网络选项卡中。

这是我的代码：

.htaccess 文件：

RewriteEngine  on
RewriteCond %{REQUEST_FILENAME}.php -f
RewriteCond %{REQUEST_URI} !^/\.well-known/cpanel-dcv/[0-9a-zA-Z_-]+$
RewriteCond %{REQUEST_URI} !^/\.well-known/pki-validation/(?:\ Ballot169)?
RewriteCond %{REQUEST_URI} !^/\.well-known/pki-validation/[A-F0-9]{32}\.txt(?:\ Comodo\ DCV)?$
RewriteRule !.*\.php$ %{REQUEST_FILENAME}.php [QSA,L]


RewriteEngine On
RewriteCond %{HTTPS} off
RewriteCond %{REQUEST_URI} !^/\.well-known/cpanel-dcv/[0-9a-zA-Z_-]+$
RewriteCond %{REQUEST_URI} !^/\.well-known/pki-validation/(?:\ Ballot169)?
RewriteCond %{REQUEST_URI} !^/\.well-known/pki-validation/[A-F0-9]{32}\.txt(?:\ Comodo\ DCV)?$
RewriteCond %{SERVER_PORT} 80

    


RewriteRule (.*) https://%{SERVER_NAME}/$1 [R,L]
Options -Indexes
    Header set X-XSS-Protection "1; mode=block"
    Header append X-Frame-Options: "SAMEORIGIN"
    Header set X-Content-Type-Options nosniff
    
# BEGIN cPanel-generated php ini directives, do not edit
# Manual editing of this file may result in unexpected behavior.
# To make changes to this file, use the cPanel MultiPHP INI Editor (Home >> Software >> MultiPHP INI Editor)
# For more information, read our documentation (https://go.cpanel.net/EA4ModifyINI)
<IfModule php7_module>
   php_flag display_errors Off
   php_value max_execution_time 60
   php_value max_input_time 60
   php_value max_input_vars 1000
   php_value memory_limit 256M
   php_value post_max_size 32M
   php_value session.gc_maxlifetime 1440
   php_value session.save_path "/var/cpanel/php/sessions/ea-php70"
   php_value upload_max_filesize 64M
   php_flag zlib.output_compression Off
</IfModule>
<IfModule lsapi_module>
   php_flag display_errors Off
   php_value max_execution_time 60
   php_value max_input_time 60
   php_value max_input_vars 1000
   php_value memory_limit 256M
   php_value post_max_size 32M
   php_value session.gc_maxlifetime 1440
   php_value session.save_path "/var/cpanel/php/sessions/ea-php70"
   php_value upload_max_filesize 64M
   php_flag zlib.output_compression Off
</IfModule>
# END cPanel-generated php ini directives, do not edit

### If mod_rewrite is true...
<IfModule mod_rewrite.c>
    Header set X-XSS-Protection "1; mode=block"
    Header always append X-Frame-Options SAMEORIGIN
    Header set X-Content-Type-Options nosniff
### Prevent Apache from showing its server signature...
ServerSignature off
### Prevent phpinfo from showing details...
RewriteCond %{QUERY_STRING} =PHP[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12} [NC] 
RewriteRule .* - [F]

</IfModule>

# X-XSS-Protection
<IfModule mod_headers.c>
    Header set X-XSS-Protection "1; mode=block"
    Header always append X-Frame-Options SAMEORIGIN
    Header set X-Content-Type-Options nosniff
</IfModule>

# php -- BEGIN cPanel-generated handler, do not edit
# Set the “ea-php70” package as the default “PHP” programming language.
<IfModule mime_module>
  AddHandler application/x-httpd-ea-php70 .php .php7 .phtml
</IfModule>
# php -- END cPanel-generated handler, do not edit

header.php 文件：

<?php
 // I included these headers at the top of my header.php file that is included everywhere in my website files.
 header("X-XSS-Protection: 1; mode=block");
 header("X-Frame-Options: SAMEORIGIN");
?>

Answer 1

我发现问题在于 headers are already being sent 错误，解决方法是在我的文件开头的 php 标记打开之前删除空格。

导致错误的先前代码：

 <?php
   //my code
 ?>

删除空格解决了这个问题：

<?php
       //my code
     ?>

Answer 2

你如何测试它现在是否工作？我的意思是添加了代码，并且您的网站现在可以防止 XSS 和点击劫持？