fix(helmet): disable breaking headers (#780)

americanexpress · Jul 19, 2022 · 7fd51d7 · 7fd51d7
1 parent e36f1c8
commit 7fd51d7
Showing 1 changed file with 6 additions and 1 deletion.
diff --git a/src/server/ssrServer.js b/src/server/ssrServer.js
@@ -69,7 +69,12 @@ export function createApp({ enablePostToModuleRoutes = false } = {}) {
 
   app.disable('x-powered-by');
   app.disable('e-tag');
-  app.use(helmet());
+  app.use(helmet({
+    crossOriginEmbedderPolicy: false,
+    crossOriginOpenerPolicy: false,
+    crossOriginResourcePolicy: false,
+    originAgentCluster: false,
+  }));
   app.use(csp());
   app.use(cookieParser());
   app.use(json({