The Axon Server UI does not generate several HTTP headers that are part of security Best Practices

[bert-laverman]

When testing the UI with https://securityheaders.com, 4 headers are shown as missing:

• Content-Security-Policy can restrict what sites may be used for loading e.g. JavaScript
• X-Frame-Options is to prevent click-jacking where the page is shown in an IFrame
• Referrer-Policy is only relevant when a page contains links going to other sites and controls if the browser is allowed to tell that other site where it came from.
• Permissions-Policy is about allowing (or disallowing) browser options such as the usage of the microphone and camera while on this page.

See https://developer.okta.com/blog/2021/10/18/security-headers-best-practices