FinishResponseSubscriber::onRespond

public FinishResponseSubscriber::onRespond(FilterResponseEvent $event)

public function onRespond(FilterResponseEvent $event) {
  if (!$event->isMasterRequest()) {
    return;
  }

  $request = $event->getRequest();
  $response = $event->getResponse();

  // Set the X-UA-Compatible HTTP header to force IE to use the most recent
  // rendering engine.
  $response->headers->set('X-UA-Compatible', 'IE=edge', FALSE);

  // Set the Content-language header.
  $response->headers->set('Content-language', $this->languageManager->getCurrentLanguage()->getId());

  // Prevent browsers from sniffing a response and picking a MIME type
  // different from the declared content-type, since that can lead to
  // XSS and other vulnerabilities.
  // https://www.owasp.org/index.php/List_of_useful_HTTP_headers
  $response->headers->set('X-Content-Type-Options', 'nosniff', FALSE);
  $response->headers->set('X-Frame-Options', 'SAMEORIGIN', FALSE);

  // If the current response isn't an implementation of the
  // CacheableResponseInterface, we assume that a Response is either
  // explicitly not cacheable or that caching headers are already set in
  // another place.
  if (!$response instanceof CacheableResponseInterface) {
    if (!$this->isCacheControlCustomized($response)) {
      $this->setResponseNotCacheable($response, $request);
    }

    // HTTP/1.0 proxies do not support the Vary header, so prevent any caching
    // by sending an Expires date in the past. HTTP/1.1 clients ignore the
    // Expires header if a Cache-Control: max-age directive is specified (see
    // RFC 2616, section 14.9.3).
    if (!$response->headers->has('Expires')) {
      $this->setExpiresNoCache($response);
    }
    return;
  }

  if ($this->debugCacheabilityHeaders) {
    // Expose the cache contexts and cache tags associated with this page in a
    // X-Drupal-Cache-Contexts and X-Drupal-Cache-Tags header respectively.
    $response_cacheability = $response->getCacheableMetadata();
    $response->headers->set('X-Drupal-Cache-Tags', implode(' ', $response_cacheability->getCacheTags()));
    $response->headers->set('X-Drupal-Cache-Contexts', implode(' ', $this->cacheContextsManager->optimizeTokens($response_cacheability->getCacheContexts())));
  }

  $is_cacheable = ($this->requestPolicy->check($request) === RequestPolicyInterface::ALLOW) && ($this->responsePolicy->check($response, $request) !== ResponsePolicyInterface::DENY);

  // Add headers necessary to specify whether the response should be cached by
  // proxies and/or the browser.
  if ($is_cacheable && $this->config->get('cache.page.max_age') > 0) {
    if (!$this->isCacheControlCustomized($response)) {
      // Only add the default Cache-Control header if the controller did not
      // specify one on the response.
      $this->setResponseCacheable($response, $request);
    }
  }
  else {
    // If either the policy forbids caching or the sites configuration does
    // not allow to add a max-age directive, then enforce a Cache-Control
    // header declaring the response as not cacheable.
    $this->setResponseNotCacheable($response, $request);
  }
}