Skip to content

Conversation

chindris
Copy link
Contributor

Package(s) involved

amazeelabs/publisher

Description of changes

After the feedback from the LGT penetration test, there is the need for additional response headers in the publisher app. Some of them might makes sense for some cases, others not, so this change gives the possibility to have configure custom response headers (that apply for every route in the publisher app).
The default setup is to set the following headers:

  • X-Frame-Options: deny
  • X-Content-Type-Options: nosniff
  • Content-Security-Policy: frame-ancestors 'none'
    The above list could be of course amended for the default setup.

How has this been tested?

Locally, manually.

@chindris chindris merged commit b2ef89c into development Sep 17, 2024
3 checks passed
@chindris chindris deleted the publisher-response-headers branch September 17, 2024 09:46
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants