mirror of
https://github.com/fleetdm/fleet
synced 2026-05-23 08:58:41 +00:00
4042f8d826
related to #8031, this adds the following headers to HTML responses: - Strict-Transport-Security: informs browsers that the site should only be accessed using HTTPS, and that any future attempts to access it using HTTP should automatically be converted to HTTPS. - X-Frames-Options: disallows embedding the UI in other sites via <frame>, <iframe>, <embed> or <object>, which can prevent attacks like clickjacking. - X-Content-Type-Options: prevents browsers from trying to guess the MIME type which can cause browsers to transform non-executable content into executable content. - Referrer-Policy: prevents leaking the origin of the referrer in the Referer. additionally, this ensures we set `X-Content-Type-Options` for CSV and installer responses. |
||
|---|---|---|
| .. | ||
| authz | ||
| bindata | ||
| config | ||
| contexts | ||
| datastore | ||
| errorstore | ||
| fleet | ||
| health | ||
| launcher | ||
| live_query | ||
| logging | ||
| mdm/apple | ||
| mock | ||
| policies | ||
| ptr | ||
| pubsub | ||
| service | ||
| sso | ||
| test | ||
| vulnerabilities | ||
| webhooks | ||
| websocket | ||
| worker | ||
| utils.go | ||