hazza/hinode
1
0
Fork 0
mirror of https://github.com/gethinode/hinode.git synced 2025-10-13 13:03:13 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #14 from markdumay/npm

Browse Source 
Security headers
This commit is contained in:
Mark Dumay
2022-04-02 06:22:03 +02:00
committed by GitHub
parent 02f093e30d 96456eadab
commit c4be8c7381
2 changed files with 32 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
layouts/index.headers
View File

@@ -1,10 +0,0 @@
/*
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Content-Security-Policy: default-src 'self'; font-src https://fonts.gstatic.com https://fonts.googleapis.com; img-src 'self'; object-src 'none'; script-src 'self' https://cdn.jsdelivr.net; style-src 'self'
X-Frame-Options: SAMEORIGIN
Referrer-Policy: strict-origin
Permissions-Policy: vibrate=(), geolocation=(), midi=(), notifications=(), push=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), speaker=(), vibrate=(), fullscreen=(), payment=()
Cache-Control: public, max-age=31536000
Access-Control-Allow-Origin: *

17
netlify.toml
View File

@@ -9,6 +9,23 @@
[context.production]
command = "npm run build"
[context.production.environment]
HUGO_VERSION = "0.83.1"
HUGO_ENV = "production"
HUGO_ENABLEGITINFO = "true"
[[headers]]
for = "/*"
[headers.values]
Strict-Transport-Security = "max-age=31536000; includeSubDomains; preload"
X-Content-Type-Options = "nosniff"
X-XSS-Protection = "1; mode=block"
Content-Security-Policy = "default-src 'self'; font-src https://fonts.gstatic.com https://fonts.googleapis.com; img-src 'self'; object-src 'none'; script-src 'self' https://cdn.jsdelivr.net; style-src 'self'"
X-Frame-Options = "SAMEORIGIN"
Referrer-Policy = "strict-origin"
Permissions-Policy = "vibrate=(), geolocation=(), midi=(), notifications=(), push=(), sync-xhr=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), speaker=(), vibrate=(), fullscreen=(), payment=()"
Cache-Control = "public, max-age=31536000"
Access-Control-Allow-Origin = "*"
[context.deploy-preview]
command = "npm run build -- -b $DEPLOY_PRIME_URL"