spb/maclustr-research

1/** Security headers applied to every response. The site never calls a private node from the browser. */2const csp = [3  "default-src 'self'",4  "script-src 'self' 'unsafe-inline'",5  "style-src 'self' 'unsafe-inline'",6  "img-src 'self' data: blob:",7  "font-src 'self'",8  "connect-src 'self'",9  "frame-ancestors 'none'",10  "base-uri 'self'",11  "form-action 'self'",12  "object-src 'none'",13].join("; ");1415export const securityHeaders = [16  { key: "Content-Security-Policy", value: csp },17  { key: "X-Content-Type-Options", value: "nosniff" },18  { key: "X-Frame-Options", value: "DENY" },19  { key: "Referrer-Policy", value: "strict-origin-when-cross-origin" },20  { key: "Permissions-Policy", value: "camera=(), microphone=(), geolocation=(), interest-cohort=()" },21  { key: "Strict-Transport-Security", value: "max-age=31536000; includeSubDomains" },22];23