fix: add permissions-policy header (#1059)

zitadel · Dec 7, 2020 · 6d210c3 · 6d210c3
1 parent 300ade6
commit 6d210c3
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 0 deletions.
diff --git a/internal/api/http/header.go b/internal/api/http/header.go
@@ -30,6 +30,7 @@ const (
 	XContentTypeOptions     = "x-content-type-options"
 	ReferrerPolicy          = "referrer-policy"
 	FeaturePolicy           = "feature-policy"
+	PermissionsPolicy       = "permissions-policy"
 
 	ZitadelOrgID = "x-zitadel-orgid"
 )

diff --git a/internal/api/http/middleware/security_headers.go b/internal/api/http/middleware/security_headers.go
@@ -70,6 +70,7 @@ func (h *headers) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	headers.Set(http_utils.XContentTypeOptions, "nosniff")
 	headers.Set(http_utils.ReferrerPolicy, "same-origin")
 	headers.Set(http_utils.FeaturePolicy, "payment 'none'")
+	headers.Set(http_utils.PermissionsPolicy, "payment=()")
 	//PLANNED: add expect-ct
 
 	h.handler.ServeHTTP(w, r)