Updated csp and headers

2022-01-18 13:59:44 +00:00
parent 674dcef43e
commit 5af7b78a44
5 changed files with 54 additions and 17 deletions
@@ -27,14 +27,30 @@ const securityHeaders = [
        key: "X-Frame-Options",
        value: "SAMEORIGIN",
    },
+    {
+        key: "X-Content-Type-Options",
+        value: "nosniff",
+    },
+    {
+        key: "X-Permitted-Cross-Domain-Policies",
+        value: "none",
+    },
+    {
+        key: "Referrer-Policy",
+        value: "origin-when-cross-origin", //no-referrer
+    },
    {
        key: "Strict-Transport-Security",
        value: "max-age=63072000; includeSubDomains; preload",
    },
    {
-        key: "Content-Security-Policy",
-        value: "frame-src 'self'; child-src 'self'",
+        key: "X-XSS-Protection",
+        value: "1; mode=block",
    },
+    // {
+    //     key: "Content-Security-Policy",
+    //     value: "frame-src 'self'; child-src 'self';object-src 'none'; script-src 'self' 'https://www.googletagmanager.com' unsafe-inline",
+    // },
 ];

 module.exports = {