fix: add baseline browser security headers for api and nginx

2026-03-22 14:08:17 +01:00
parent 4ccfd6d055
commit c296e26b6c
2 changed files with 5 additions and 6 deletions
@@ -2,6 +2,11 @@ server {
  listen 80;
  server_name _;

+  add_header X-Content-Type-Options "nosniff" always;
+  add_header X-Frame-Options "DENY" always;
+  add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+  add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
+
  root /usr/share/nginx/html;
  index index.html;