Add security HTTP headers

[sorcix]

Sadly, the Vue web interface needs unsafe-inline for both stylesheets and scripts, making the CSP header a bit useless.

Browsers tend to implement CSP a bit different, so this should be tested in a few browsers. The code changed in this PR is currently live on https://ots.webserve.be and works in Firefox and Chrome.

Please rebase onto master and resolve conflicts

[sorcix]

White testing this I encountered a content encoding error in the view-source option in Firefox.

Checking what's causing this.

[sorcix]

It was a missing Content-Type header. Also changed the template a bit.

Should have noticed this while I was checking #47, sorry!

[sorcix]

Should I add Cache-Control headers? I've not added them because I'm not sure if it's a good idea to have this by default, as it could break when people that don't know about them update their instance. I currently add them using an nginx proxy.

[Luzifer]

Should I add Cache-Control headers? I've not added them because I'm not sure if it's a good idea to have this by default, as it could break when people that don't know about them update their instance. I currently add them using an nginx proxy.

I think adding Cache-Control header by default will break a lot of things. We're not delivering any parameters for cache invalidation. So depending on the content of the headers this might force users to force-reload to fix broken assets… And from my experience with users they don't know how to do this and will experience a broken application…

Depending on which headers you are adding in the proxy your users might experience this too…

[sorcix]

I think adding Cache-Control header by default will break a lot of things. We're not delivering any parameters for cache invalidation. So depending on the content of the headers this might force users to force-reload to fix broken assets… And from my experience with users they don't know how to do this and will experience a broken application…

Depending on which headers you are adding in the proxy your users might experience this too…

Agree. I'll keep them in my nginx config.