tec: Add Referrer-Policy and X-Content-Type-Options headers

flusio · Sep 9, 2022 · fe2e227 · fe2e227
1 parent f3fdf68
commit fe2e227
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 0 deletions.
diff --git a/src/Application.php b/src/Application.php
@@ -138,6 +138,8 @@ public function run($request)
 
         $response->setContentSecurityPolicy('style-src', "'self' 'unsafe-inline'");
         $response->setHeader('Permissions-Policy', 'interest-cohort=()'); // @see https://cleanuptheweb.org/
+        $response->setHeader('Referrer-Policy', 'same-origin');
+        $response->setHeader('X-Content-Type-Options', 'nosniff');
         $response->setHeader('X-Frame-Options', 'deny');
 
         if (

diff --git a/tests/ApplicationTest.php b/tests/ApplicationTest.php
@@ -164,6 +164,8 @@ public function testHeaders()
 
         $headers = $response->headers(true);
         $this->assertSame('interest-cohort=()', $headers['Permissions-Policy']);
+        $this->assertSame('same-origin', $headers['Referrer-Policy']);
+        $this->assertSame('nosniff', $headers['X-Content-Type-Options']);
         $this->assertSame('deny', $headers['X-Frame-Options']);
         $this->assertSame([
             'default-src' => "'self'",