[Docs] Example caddy configuration breaks Webauthn login

[ghost]

I set up my server as per the example in the Caddy + Cloudflare DNS wiki page, and enabled the commented-out "uncomment to improve security" section, since the settings there make sense to me. Unfortunately, this breaks Webauthn login, since it embeds the web UI into itself.

I suggest this change:

+  header /webauthn-connector.html {
+       # allow embedding webauthn page onto sign-in page
+       X-Frame-Options "SAMEORIGIN"
+   }

I'm not sure if there's any other pages on the web UI that also require embedding

[BlackDex]

Hello @spiralw,

Thanks for mentioning this.
Since it is a wiki, you are free to add and update it your self.
Just add it as a comment or a notice.

Also, if you add that header it will still break on some other clients.
All security headers are already sent by Vaultwarden it self, and there should be no need to add custom ones.

Besides maybe the HSTS, but that is something you want to set your self.

For which headers are set see:

vaultwarden/src/util.rs

Line 32 in ce9d930

async fn on_response<'r>(&self, req: &'r Request<'_>, res: &mut Response<'r>) {