docs(security): document stored asset CSP for 6.6

[Jonas Elfering (keulinho)]

Summary

Document stored-asset CSP protection for Shopware 6.6. Update the Apache, Nginx and Caddy examples for stored HTML and SVG. Application-rendered pages and bundled HTML applications retain their existing behavior. Preserve version-specific installer and recovery routing.

Add XSS on stored assets to the security reference, linking to the webserver and reverse-cache guidance. Explain that a dedicated CDN serving assets from a different CDN URL needs manual response-header configuration. Reverse proxies must preserve the origin CSP, including cached responses; Shopware's default Fastly and Varnish configurations already do so. Existing webserver configurations must be updated and deployed. The reverse-cache guide remains unchanged; no VCL snippets or new proxy policies are documented.

Related links

• docs(security): document stored asset CSP and CDN requirements #2613
• fix(media): align Apache static-asset CSP across recipes recipes#270
• fix(webserver): align static HTML and SVG CSP docker#245
• fix(media): apply CSP to static HTML and SVG assets shopware#21659

Checklist

• I reviewed affected links, code samples, and cross-references, including PageRef references where relevant.
• No pages were moved, renamed, or deleted; no redirects are needed.
• Spelling checks pass without wordlist additions.
• Any required dependent changes in downstream modules have already been merged and published.
• This pull request is ready for review.

Notes

Markdown lint passes for the server examples using the current docs configuration; spelling and link checks pass for the security reference. The Apache example places the policy directly in its existing virtual-host block and is identical to the current-docs version, which passes Apache syntax validation and 12 HTTP cases with a fixture PHP front controller. Missing HTML media also retains the application's policy. Earlier validation of the unchanged 6.6 Nginx config block passed native syntax validation and 13 HTTP cases; the Caddy config block matches the validated current-docs example. Origin CSP propagation was verified against the existing Varnish configs and adapted Fastly snippets locally. No full documentation-site build or live Fastly validation was performed. Keep this draft until the linked webserver configuration changes are available. The closed 6.4 and 6.5 documentation PRs remain closed.

[shopware-dev-docs-connector]

Developer Docs healthcheck

Status: Completed with failure.
Repository: shopware/docs
Commit: 16555fd
Preview: No Vercel preview URL was found in the workflow logs.
Workflow run: #5660