What Security Headers should and can be set but still have a workin UI and API ? (with traefik)

[flomickl]

Hi

I am using traefik behind my dependency track API and UI.

Everything is working but now I want to set some secure headers.
At the moment I got an ugly "F" score

Normal y I use my middleware sec Headers, but with this, the UI login page for example is not working anymore and probably the API could be affected in some unknowns ways as well (i guess)
I just get a background screen without login or something else.

So my questions is
What are the recommended values and settings I should use, if I am using dependency Track API and UI with TLS?

Here is my traefik middleware snippet to start with

http:
  middlewares:
    secHeaders:
      headers:                    # set some security headers
        browserXssFilter: true
        contentTypeNosniff: true
        frameDeny: true
        stsIncludeSubdomains: true
        stsPreload: true
        stsSeconds: 31536000
        customFrameOptionsValue: "SAMEORIGIN"
        addVaryheader: true
        contentSecurityPolicy: "script-src 'self'"
        strict-origin-when-cross-origin
        sslForceHost: true
        forceSTSHeader: true
        sslRedirect: true
        sslTemporaryRedirect: true
        customResponseHeaders:
          server: ""
          x-powered-by: ""
          Permissions-Policy: "geolocation=(), microphone=(), camera=(), fullscreen=(), payment=(), usb=()"