Skip to content

v1.7.0

Choose a tag to compare

View all tags
@MichelleFindlay MichelleFindlay released this 24 Oct 19:19
· 4 commits to main since this release
v1.7.0
55fd457

Security headers (A+ on securityheaders.com)

Every page and endpoint now sends security headers from PHP. You don't need to change your web server config, so this works on shared hosting too.

  • Strict-Transport-Security: max-age=31536000; includeSubDomains
  • Content-Security-Policy: only scripts carrying a per-request nonce can run, so the policy doesn't need 'unsafe-inline' for scripts. Album art can still load from any HTTPS host.
  • X-Frame-Options: SAMEORIGIN
  • X-Content-Type-Options: nosniff
  • Referrer-Policy: strict-origin-when-cross-origin
  • Permissions-Policy: turns off camera, microphone, geolocation, payment, USB and motion sensors
  • Cross-Origin-Opener-Policy and Cross-Origin-Resource-Policy: same-origin
  • PHP's X-Powered-By header is removed, so the response no longer shows your PHP version.
  • The JSON endpoints (api.php, widgets.php, films.php, listen_links.php, mcp.php) send a policy that blocks everything, since they never render a page.

Footer: DNSSEC and security-header checks

A new line under "Powered by" shows a tick or cross for:

  • DNSSEC: whether your domain's DNS records are signed and validate. The result is checked through Cloudflare's public DNS resolver, cached for 24 hours, and links to Verisign's DNSSEC Analyzer.
  • Security headers: whether all six headers that securityheaders.com grades are being sent. Links to a securityheaders.com scan of your site.

The line is hidden on localhost or when the site is reached by IP address.

Fixes

  • Broken thumbnails on Favourite Tracks and Trending rows still fall back to the letter placeholder. The fallback used an inline onerror attribute, which the new policy blocks, so it now lives in assets/app.js.

Upgrade notes

  • Behind Cloudflare? Cloudflare features that add their own scripts to the page will be blocked by the new policy. These include Rocket Loader, Email Address Obfuscation and automatic Web Analytics. Turn them off in your Cloudflare dashboard if they're on.
  • HSTS tells browsers to use only HTTPS for your domain and all its subdomains for a year. Make sure HTTPS works everywhere on the domain before you deploy.
  • You don't need to change config.php.
Assets 2
Loading