fix(server): adds XFrameOptions and ContentSecurityPolicy headers

2026-07-18 19:39:53 +02:00
parent 31a86ed234
commit 6240030dd5
1 changed files with 2 additions and 0 deletions
@@ -92,6 +92,8 @@ app.Use(async (context, next) =>
    context.Response.Headers.AccessControlAllowOrigin = "*";
    context.Response.Headers.AccessControlAllowMethods = "GET, POST, PUT, DELETE, PATCH, OPTIONS";
    context.Response.Headers.AccessControlAllowHeaders = "Content-Type, Authorization";
+    context.Response.Headers.XFrameOptions = "DENY";
+    context.Response.Headers.ContentSecurityPolicy = "frame-ancestors 'none'";

    if (HttpMethods.IsOptions(context.Request.Method))
    {