Security (medium): baseline browser security headers issue #222 closed: completed andymccall opened this 20 days ago · 0 comments

External review: no Content-Security-Policy, frame protection, X-Content-Type-Options, Referrer-Policy, Permissions-Policy or HSTS. Global middleware: CSP default-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'; form-action 'self' (+ the backdrop's wasm and inline scripts moved to files or given nonces; report-only first), X-Content-Type-Options nosniff, Referrer-Policy strict-origin-when-cross-origin, a restrictive Permissions-Policy; HSTS after issue #1. Reports frames (issue #127) keep their own sandboxed policy.