fleet/changes/8031-security-headers at 3953a1f4dd963bad4ce5698d42eae8d7ba07d773 - Elgato_dark/fleet - Forgejo: Beyond coding. We Forge.

Elgato_dark/fleet

mirror of https://github.com/fleetdm/fleet synced 2026-04-21 13:37:30 +00:00

Roberto Dip 4042f8d826

add browser-related security headers to HTML responses (#8180 )

related to #8031, this adds the following headers to HTML responses:

- Strict-Transport-Security: informs browsers that the site should only
  be accessed using HTTPS, and that any future attempts to access it
  using HTTP should automatically be converted to HTTPS.
- X-Frames-Options: disallows embedding the UI in other sites via
  <frame>, <iframe>, <embed> or <object>, which can prevent attacks like
  clickjacking.
- X-Content-Type-Options: prevents browsers from trying to guess the MIME
  type which can cause browsers to transform non-executable content into
  executable content.
- Referrer-Policy: prevents leaking the origin of the referrer in the
  Referer.

additionally, this ensures we set `X-Content-Type-Options` for CSV and
installer responses.

2022-10-12 10:19:21 -03:00

1 line

63 B

Text

Raw Blame History

- Added security headers to HTML, CSV and installer responses.