feat: add security headers

penguin-statistics · Oct 12, 2022 · 97a24b2 · 97a24b2
1 parent befff2b
commit 97a24b2
Showing 1 changed file with 8 additions and 0 deletions.
diff --git a/main.go b/main.go
@@ -37,6 +37,14 @@ func main() {
 			return c.SendStatus(fiber.StatusBadRequest)
 		}
 
+		c.Set("Content-Type", "text/html; charset=utf-8")
+		c.Set("Cache-Control", "public, max-age=86400")
+		c.Set("Vary", "Accept-Encoding")
+		c.Set("Content-Security-Policy", "default-src 'none'; sandbox") // https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/sandbox
+		c.Set("X-Content-Type-Options", "nosniff")
+		c.Set("X-Frame-Options", "DENY")
+		c.Set("X-XSS-Protection", "1; mode=block")
+
 		return tmpl.Execute(c, fiber.Map{
 			"pkg": pkg,
 		})