// src/EventListener/SecurityHeadersListener.php
class SecurityHeadersListener
{
    public function onKernelResponse(ResponseEvent $event): void
    {
        $response = $event->getResponse();
        
        // CSP stricte avec nonce pour les scripts
        $nonce = base64_encode(random_bytes(16));
        $csp = "default-src 'self'; " .
               "script-src 'self' 'nonce-{$nonce}'; " .
               "style-src 'self' 'unsafe-inline'; " .
               "img-src 'self' data: https:; " .
               "connect-src 'self'; " .
               "font-src 'self' https://fonts.gstatic.com; " .
               "object-src 'none'; " .
               "base-uri 'self'; " .
               "form-action 'self'; " .
               "frame-ancestors 'none'";
        
        $response->headers->set('Content-Security-Policy', $csp);
        
        // Headers de sécurité additionnels
        $response->headers->set('X-XSS-Protection', '1; mode=block');
        $response->headers->set('X-Content-Type-Options', 'nosniff');
        $response->headers->set('X-Frame-Options', 'DENY');
        $response->headers->set('Referrer-Policy', 'strict-origin-when-cross-origin');
        
        // Stocker le nonce pour les templates
        $event->getRequest()->attributes->set('csp_nonce', $nonce);
    }
}

#[Route('/search')]
public function search(Request $request, ValidatorInterface $validator): Response
{
    $query = $request->query->get('q', '');
    
    // Validation avec contraintes Symfony
    $violations = $validator->validate($query, [
        new Assert\Length(['max' => 100]),
        new Assert\NotBlank(),
        new Assert\Regex([
            'pattern' => '/^[a-zA-Z0-9\s\-_]*$/',
            'message' => 'Caractères non autorisés'
        ])
    ]);
    
    if (count($violations) > 0) {
        throw new BadRequestException('Données invalides');
    }
    
    // Sanitisation supplémentaire
    $query = strip_tags($query);
    $query = htmlspecialchars($query, ENT_QUOTES | ENT_HTML5, 'UTF-8');
    
    return $this->render('search.html.twig', [
        'query' => $query  // Échappement automatique Twig
    ]);
}

// Doctrine DBAL - Requêtes préparées manuelles
public function findUsersByCity(string $city): array
{
    $conn = $this->getEntityManager()->getConnection();
    
    // 1. Préparation : structure SQL avec placeholders
    $sql = 'SELECT * FROM users WHERE city = :city AND active = :active';
    $stmt = $conn->prepare($sql);
    
    // 2. Exécution : paramètres liés séparément
    $stmt->bindValue('city', $city, \PDO::PARAM_STR);
    $stmt->bindValue('active', true, \PDO::PARAM_BOOL);
    
    return $stmt->executeQuery()->fetchAllAssociative();
}

// FormType avec protection CSRF
class TransferType extends AbstractType
{
    public function buildForm(FormBuilderInterface $builder, array $options): void
    {
        $builder
            ->add('amount', MoneyType::class)
            ->add('toAccount', TextType::class)
            ->add('submit', SubmitType::class);
    }
    
    public function configureOptions(OptionsResolver $resolver): void
    {
        $resolver->setDefaults([
            'csrf_protection' => true,        // Activé par défaut
            'csrf_field_name' => '_token',
            'csrf_token_id' => 'transfer_form',
        ]);
    }
}

// Entity avec contraintes
class User
{
    #[Assert\NotBlank(message: 'Email obligatoire')]
    #[Assert\Email(message: 'Email invalide')]
    private string $email;
    
    #[Assert\Length(
        min: 8,
        max: 255,
        minMessage: 'Mot de passe trop court ({{ limit }} min)',
        maxMessage: 'Mot de passe trop long ({{ limit }} max)'
    )]
    #[Assert\Regex(
        pattern: '/^(?=.*[a-z])(?=.*[A-Z])(?=.*\d)/',
        message: 'Doit contenir majuscule, minuscule et chiffre'
    )]
    private string $password;
    
    #[Assert\Choice(choices: ['draft', 'published', 'archived'])]
    private string $status = 'draft';
}

#[Route('/user/create', methods: ['POST'])]
public function create(Request $request, ValidatorInterface $validator): Response
{
    $user = new User();
    $user->setEmail($request->request->get('email'));
    $user->setPassword($request->request->get('password'));
    
    // Validation
    $errors = $validator->validate($user);
    
    if (count($errors) > 0) {
        $errorMessages = [];
        foreach ($errors as $error) {
            $errorMessages[] = $error->getMessage();
        }
        
        return $this->json(['errors' => $errorMessages], 400);
    }
    
    // Traitement sécurisé...
}

// EventListener pour headers automatiques
public function onKernelResponse(ResponseEvent $event): void
{
    $response = $event->getResponse();
    
    // Force HTTPS pour les futures requêtes
    $response->headers->set('Strict-Transport-Security', 
        'max-age=31536000; includeSubDomains; preload');
    
    // Politique de sécurité du contenu
    $response->headers->set('Content-Security-Policy', 
        "default-src 'self'; script-src 'self'");
    
    // Protection contre le clickjacking
    $response->headers->set('X-Frame-Options', 'DENY');
    
    // Empêcher le sniffing MIME
    $response->headers->set('X-Content-Type-Options', 'nosniff');
    
    // Référer policy
    $response->headers->set('Referrer-Policy', 'strict-origin-when-cross-origin');
}