andwati/telecom-platform
1
0
Fork 0
mirror of https://github.com/andwati/telecom-platform.git synced 2026-10-18 11:02:54 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat: Add CSP, Referrer-Policy, and Permissions-Policy headers to SecurityHeadersMiddleware

Browse Source 
- Add Content-Security-Policy header with self-only defaults and unsafe-inline styles
- Add Referrer-Policy header with strict-origin-when-cross-origin
- Add Permissions-Policy header blocking geolocation, microphone, and camera access
This commit is contained in:
nutcas3
2026-05-01 09:05:02 +03:00
parent 5b6cee5618
commit 49dc77d241
1 changed files with 3 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/api-server/internal/middleware/performance.go
+3
View File
@@ -260,6 +260,9 @@ func SecurityHeadersMiddleware() gin.HandlerFunc {
c.Header("X-Frame-Options", "DENY")
c.Header("X-XSS-Protection", "1; mode=block")
c.Header("Strict-Transport-Security", "max-age=31536000; includeSubDomains")
c.Header("Content-Security-Policy", "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'")
c.Header("Referrer-Policy", "strict-origin-when-cross-origin")
c.Header("Permissions-Policy", "geolocation=(), microphone=(), camera=()")
c.Next()
}
}