Add Cross-Origin-Resource-Policy header to embeddable files

Fixes mjackson#290. See more: https://resourcepolicy.fyi/
adamchainz · Apr 29, 2021 · a068af3 · a068af3
1 parent a7ebffa
commit a068af3
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 2 deletions.
diff --git a/modules/actions/serveFile.js b/modules/actions/serveFile.js
@@ -18,7 +18,8 @@ export default function serveFile(req, res) {
       'Cache-Control': 'public, max-age=31536000', // 1 year
       'Last-Modified': req.entry.lastModified,
       ETag: etag(req.entry.content),
-      'Cache-Tag': tags.join(', ')
+      'Cache-Tag': tags.join(', '),
+      'Cross-Origin-Resource-Policy': 'cross-origin',
     })
     .send(req.entry.content);
 }
diff --git a/modules/actions/serveJavaScriptModule.js b/modules/actions/serveJavaScriptModule.js
@@ -16,7 +16,8 @@ export default function serveJavaScriptModule(req, res) {
         'Content-Type': getContentTypeHeader(req.entry.contentType),
         'Cache-Control': 'public, max-age=31536000', // 1 year
         ETag: etag(code),
-        'Cache-Tag': 'file, js-file, js-module'
+        'Cache-Tag': 'file, js-file, js-module',
+        'Cross-Origin-Resource-Policy': 'cross-origin',
       })
       .send(code);
   } catch (error) {