Set the 'X-Frame-Options' headers to prevent click-jacking, unless
specifically disabled. Backend only!

@param Request  $request
@param Response $response
540639
protected function setFrameOptions(Request $request, Response $response)
    {
        if (Zone::isBackend($request) && $this->app['config']->get('general/headers/x_frame_options')) {
            $response->headers->set('X-Frame-Options', 'SAMEORIGIN');
            $response->headers->set('Frame-Options', 'SAMEORIGIN');
        }
    }
197246
private function send(RequestInterface $request, ResponseInterface $response)
    {
        // Send headers if no headers has been sent before this
        if (!headers_sent()) {
            // Send headers
            $this->sendHeaders($response);
        }

        // Check if we have any content to flush
        if (ob_get_level() > 1) {
            // Flush (send) the buffer that contains output that the application has generated
            while (ob_get_level() >= $this->outputBufferLevel) {
                ob_end_flush();
            }
        }

        // Set buffer level to null
        $this->outputBufferLevel = null;

        // Make sure it wasn't a HEAD request
        if ($request->getMethod() !== 'HEAD') {
            // Send the body to the client by echoing it
            echo $response->getBody();
        }
    }
1135138
public function afterSend($request, $response)
    {
        $event = new RequestEvent();
        $event->request = $request;
        $event->response = $response;
        $this->trigger(self::EVENT_AFTER_SEND, $event);
    }
1320686
protected function setNeededAction(Response $response) {
        if ($response->hasHtml())
        {
            $response->setNeededAction(Response::NEEDED_SHOW_HTML);
        }
        elseif ($response->isProcessing())
        {
            $response->setNeededAction(Response::NEEDED_STATUS_UPDATE);
        }
    }
551119
private function addCommonHeaders(Request $request, Response $response)
    {
        // replace content-type if a schema was requested
        if ($request->attributes->get('schemaRequest')) {
            $response->headers->set('Content-Type', 'application/schema+json');
        }

        if ($request->attributes->has('recordCount')) {
            $response->headers->set(
                'X-Record-Count',
                (string) $request->attributes->get('recordCount')
            );
        }

        // search source header?
        if ($request->attributes->has('X-Search-Source')) {
            $response->headers->set(
                'X-Search-Source',
                (string) $request->attributes->get('X-Search-Source')
            );
        }
    }
999029
protected function addCookieToResponse( $request, $response )
	{
		$config = Config::get( 'session' );
		$response->headers->setCookie( new Cookie( 'XSRF-TOKEN', $request->session()->token(), time() + 60 * 120, $config['path'], $config['domain'], $config['secure'], false ) );

		return $response;
	}
819341
public function modifyResponse(Request $request, Response $response)
    {
        $app = $this->app;

        if (is_admin_panel() || $app->runningInConsole() || $this->isDebugbarRequest() || $request->ajax()) {
            return $response;
        }

        $this->injectAdminBar($response);

        return $response;
    }
250702
public function updateResponseHeaders(Request $request, Response $response)
    {
        if ($this->cspDisabled) {
            $this->removeCspHeaders($response);

            return [];
        }

        $nonces = $this->getNonces($request, $response);
        $this->cleanHeaders($response);
        $this->updateCspHeaders($response, $nonces);

        return $nonces;
    }
1163768
protected function init(Request $request = null, Response $response = null, array $user_options = array())
    {
        $this->setUserOptions(
            $this->extendOptions($user_options)
        );
        foreach (array('tmp_directory', 'var_directory', 'log_directory') as $_dir) {
            DirectoryHelper::ensureExists($this->getOption($_dir));
        }
        $this->setLogger(
            new Logger($this->getLoggerOptions())
        );
        if (!is_null($request)) {
            $this->setRequest($request);
        }
        if (!is_null($response)) {
            $this->setResponse($response);
        }
        $this->getResponse()->setContentType('json');
        if ($this->getOption('enable_url_rewrite')===true) {
            $this->getRequest()
                ->setFlag(Request::REWRITE_SEGMENTS_QUERY)
                ->setArguments($this->getRequest()->getArguments())
                ;
        }
/*
echo '<pre>';
var_export($this->getRequest());
exit('yo');
*/
    }
878321
public function handleResponse(Request $request, Response $response)
    {
        if ($response->getStatusCode() == 422) {
            $errors = $response->getOriginalContent()['validation_errors'];

            throw new HttpResponseException(
                redirect()->back()->withInput($request->input())->withErrors($errors)
            );
        }

        if ($response->getStatusCode() == 403) {
            abort(403);
        }

        return $response->isNotFound() ? abort(404) : $response->getOriginalContent();
    }
756820
protected function setAccessControlAllowOriginHeader(Request $request, Response $response): Response
    {
        $origin = $request->headers->get('Origin');

        if ($this->isAllOriginsAllowed()) {
            $response->headers->set('Access-Control-Allow-Origin', '*');
        } elseif ($this->isOriginAllowed($origin)) {
            $response->headers->set('Access-Control-Allow-Origin', $origin);
        }

        return $response;
    }
67715
protected function processCacheSettings(Request $request, Response $response): void
    {
        $defaultSharedMaxAge = $this->getConfigResolver()->getParameter('view.shared_max_age', 'ngsite');

        $cacheSettings = $request->attributes->get('cacheSettings');
        if (!is_array($cacheSettings)) {
            $cacheSettings = ['sharedMaxAge' => $defaultSharedMaxAge];
        }

        $public = true;

        if (isset($cacheSettings['sharedMaxAge'])) {
            $response->setSharedMaxAge($cacheSettings['sharedMaxAge']);
            if (empty($cacheSettings['sharedMaxAge'])) {
                $public = false;
            }
        } elseif (isset($cacheSettings['maxAge'])) {
            $response->setMaxAge($cacheSettings['maxAge']);
            if (empty($cacheSettings['maxAge'])) {
                $public = false;
            }
        } else {
            $response->setSharedMaxAge($defaultSharedMaxAge);
        }

        $public ? $response->setPublic() : $response->setPrivate();
    }
613462
private function restoreResponseBody(Request $request, Response $response)
    {
        if ($response->headers->has('X-Body-Eval')) {
            ob_start();

            if ($response->headers->has('X-Body-File')) {
                include $response->headers->get('X-Body-File');
            } else {
                eval('; ?>'.$response->getContent().'<?php ;');
            }

            $response->setContent(ob_get_clean());
            $response->headers->remove('X-Body-Eval');
            if (!$response->headers->has('Transfer-Encoding')) {
                $response->headers->set('Content-Length', \strlen($response->getContent()));
            }
        } elseif ($response->headers->has('X-Body-File')) {
            // Response does not include possibly dynamic content (ESI, SSI), so we need
            // not handle the content for HEAD requests
            if (!$request->isMethod('HEAD')) {
                $response->setContent(file_get_contents($response->headers->get('X-Body-File')));
            }
        } else {
            return;
        }

        $response->headers->remove('X-Body-File');
    }
836546
protected function injectToolbar(Response $response, Request $request)
	{
		$content = $response->getContent();
		$pos = strripos($content, '</body>');

		if ($pos !== false)
		{
			$this->template->assign_vars(array(
				'position' => $this->position,
				'token' => $response->headers->get('X-Debug-Token'),
				'profiler_link' => $this->helper->route('_profiler', array('token' => $response->headers->get('X-Debug-Token'))),
				'toolbar_link' => $this->helper->route('_wdt', array('token' => $response->headers->get('X-Debug-Token'), '_referer' => $this->helper->get_current_url())),
				'excluded_ajax_paths' => $this->excludedAjaxPaths,
			));

			$this->template->set_filenames(array(
				'body'	=> "@nicofuma_webprofiler/profiler/toolbar_js.html",
			));

			$toolbar = "\n" . $this->template->assign_display('body') . "\n";
			$content = substr($content, 0, $pos) . $toolbar . substr($content, $pos);
			$response->setContent($content);
		}
	}
482878
protected function handleRequestHeader(Request $request, Response $response): Response
    {
        // 处理 No-Cache
        if ($request->header('Cache-Control') === 'no-cache') {
            $response = $response->withHeader('Cache-Control', [
                'no-store',
                'no-cache',
                'must-revalidate'
            ]);
        }

        // 处理 Gzip 请求
        // 不知道为什么，老是出错，还需要再查查
        // https://blog.csdn.net/cs958903980/article/details/76890034?locationNum=6&fps=1
        //
        // $encoding = $request->getHeaderLine('Accept-Encoding');

        // if (! empty($encoding)) {
        //     $negotiator = new EncodingNegotiator;
        //     $preferred = $negotiator->getBest($encoding, ['gzip']);

        //     if (! empty($preferred)) {
        //         $response = $response->withHeader('Content-Encoding', 'gzip');
        //         $response->setGzip(1);
        //     }
        //     unset($negotiator, $preferred);
        // }
        // unset($encoding);

        return $response;
    }
524529
public function renderRequest(Request $request, Response $response, RenderingContext $renderingContext)
    {
        $contentObjectRenderer = new ContentObjectRenderer();
        $content = $contentObjectRenderer->cObjGetSingle('RECORDS', $this->resolveRenderingConfiguration($request, $renderingContext));
        $response->setContent($content);
    }
485733
public function load(Request $request, Response $response) {
        //render the key
        $key = md5(uniqid());
        if($request->hasSession('csrf')) {
            $key = $request->getSession('csrf');
        }

        $request->setSession('csrf', $key);
        $response->setResults('csrf', $key);

        return $this;
    }