2 commits

Author	SHA1	Message	Date
Daenney	02d6e2e3bc	[feature] Set some security related headers (#3065) ... * Set frame-ancestors in the CSP This ensures we can't be loaded/embedded in an iframe. It also sets the older X-Frame-Options for fallback. * Disable MIME type sniffing * Set Referrer-Policy This sets the policy such that browsers will never send the Referer header along with a request, unless it's a request to the same protocol, host/domain and port. Basically, only send it when navigating through our own UI, but not anything external. The default is strict-origin-when-cross-origin when unset, which sends the Referer header for requests unless it's going from HTTPS to HTTP (i.e a security downgrade, hence the 'strict').	2024-07-04 10:07:02 +02:00
tobi	1e2db7a32f	[feature/bugfix] Probe S3 storage for CSP uri, add config flag for extra URIs (#2134) ... * [feature/bugfix] Probe S3 storage for CSP uri, add config flag for extra URIs * env parsing tests, my coy mistress	2023-08-20 13:35:55 +02:00