tweak to add security headers

middleware.js

@@ -40,7 +40,10 @@ export function middleware(request) {
         .trim();
 
     const requestHeaders = new Headers(request.headers);
+    // Unique trusted nonce
     requestHeaders.set("x-nonce", nonce);
+
+    // CSP policy
     requestHeaders.set(
         "Content-Security-Policy",
         contentSecurityPolicyHeaderValue
@@ -56,24 +59,29 @@ export function middleware(request) {
         contentSecurityPolicyHeaderValue
     );
 
+    // XSS protection (legacy)
+    response.headers.set("X-XSS-Protection", "1; mode=block");
+
+    // Prevent MIME type sniffing
+    response.headers.set("X-Content-Type-Options", "nosniff");
+
+    // Prevent iframe embedding
+    response.headers.set("X-Frame-Options", "DENY");
+
+    // Referrer policy
+    response.headers.set("Referrer-Policy", "strict-origin-when-cross-origin");
+
+    // Permissions lockdown
+    response.headers.set(
+        "Permissions-Policy",
+        "geolocation=(), camera=(), microphone=(), fullscreen=(self)"
+    );
+
+    // Enforce HTTPS via HSTS
+    response.headers.set(
+        "Strict-Transport-Security",
+        "max-age=63072000; includeSubDomains; preload"
+    );
+
     return response;
 }
-
-// export const config = {
-//     matcher: [
-//         /*
-//          * Match all request paths except for the ones starting with:
-//          * - api (API routes)
-//          * - _next/static (static files)
-//          * - _next/image (image optimization files)
-//          * - favicon.ico (favicon file)
-//          */
-//         {
-//             source: "/((?!api|_next/static|_next/image|favicon.ico).*)",
-//             missing: [
-//                 { type: "header", key: "next-router-prefetch" },
-//                 { type: "header", key: "purpose", value: "prefetch" },
-//             ],
-//         },
-//     ],
-// };