Merge pull request #898 from oslokommune/security-headers

Set more security headers
oslokommune · Oct 19, 2023 · 5503836 · 5503836
2 parents af105c0 + 603a5be
commit 5503836
Show file tree

Hide file tree

Showing 2 changed files with 25 additions and 0 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -11,6 +11,8 @@ All notable changes to this project will be documented in this file. The format
 
 ### Security
 
+- More security headers are now set: `Content-Security-Policy`,
+  `Referrer-Policy`, `X-Content-Type-Options`, and `X-Frame-Options`.
 - Updated dependencies.
 
 ## [3.10.0] 2023-10-10

diff --git a/firebase.json b/firebase.json
@@ -11,6 +11,29 @@
         "source": "**",
         "destination": "/index.html"
       }
+    ],
+    "headers": [
+      {
+        "source":"**",
+        "headers": [
+          {
+            "key": "Content-Security-Policy",
+            "value": "script-src 'self' 'unsafe-eval' 'unsafe-inline' apis.google.com"
+          },
+          {
+            "key": "Referrer-Policy",
+            "value": "no-referrer"
+          },
+          {
+            "key": "X-Content-Type-Options",
+            "value": "nosniff"
+          },
+          {
+            "key": "X-Frame-Options",
+            "value": "DENY"
+          }
+        ]
+      }
     ]
   },
   "storage": {