Cross-Origin-Embedder-Policy and Cross-Origin-Resource-Policy headers

Implement proposal: #6176
freedomofpress · Dec 9, 2021 · a25639f · a25639f
1 parent 4accdd7
commit a25639f
Show file tree

Hide file tree

Showing 8 changed files with 16 additions and 0 deletions.
diff --git a/install_files/ansible-base/roles/app/templates/sites-available/focal/journalist.conf b/install_files/ansible-base/roles/app/templates/sites-available/focal/journalist.conf
@@ -31,6 +31,8 @@ Header onsuccess unset X-Download-Options
 Header onsuccess unset Content-Security-Policy
 Header always set Content-Security-Policy "default-src 'none'; script-src 'self'; style-src 'self'; img-src 'self'; font-src 'self';"
 Header set Cross-Origin-Opener-Policy "same-origin"
+Header set Cross-Origin-Embedder-Policy "same-origin"
+Header set Cross-Origin-Resource-Policy "same-site"
 
 # Limit the max submitted size of requests.
 LimitRequestBody 524288000

diff --git a/install_files/ansible-base/roles/app/templates/sites-available/focal/source.conf b/install_files/ansible-base/roles/app/templates/sites-available/focal/source.conf
@@ -52,6 +52,8 @@ Header onsuccess unset X-Download-Options
 Header onsuccess unset X-Content-Type-Options
 Header always set X-Content-Type-Options "nosniff"
 Header set Cross-Origin-Opener-Policy "same-origin"
+Header set Cross-Origin-Embedder-Policy "same-origin"
+Header set Cross-Origin-Resource-Policy "same-site"
 
 Header unset Etag
 

diff --git a/molecule/testinfra/vars/app-qubes-staging.yml b/molecule/testinfra/vars/app-qubes-staging.yml
@@ -4,6 +4,8 @@ wanted_apache_headers:
   X-Content-Type-Options: nosniff
   Content-Security-Policy: "default-src 'none'; script-src 'self'; style-src 'self'; img-src 'self'; font-src 'self';"
   Cross-Origin-Opener-Policy: "same-origin"
+  Cross-Origin-Embedder-Policy: "same-origin"
+  Cross-Origin-Resource-Policy: "same-site"
 
 
 securedrop_venv: /opt/venvs/securedrop-app-code

diff --git a/molecule/testinfra/vars/app-staging.yml b/molecule/testinfra/vars/app-staging.yml
@@ -4,6 +4,8 @@ wanted_apache_headers:
   X-Content-Type-Options: nosniff
   Content-Security-Policy: "default-src 'none'; script-src 'self'; style-src 'self'; img-src 'self'; font-src 'self';"
   Cross-Origin-Opener-Policy: "same-origin"
+  Cross-Origin-Embedder-Policy: "same-origin"
+  Cross-Origin-Resource-Policy: "same-site"
 
 securedrop_venv: /opt/venvs/securedrop-app-code
 securedrop_venv_bin: /opt/venvs/securedrop-app-code/bin

diff --git a/molecule/testinfra/vars/prod.yml b/molecule/testinfra/vars/prod.yml
@@ -4,6 +4,8 @@ wanted_apache_headers:
   X-Content-Type-Options: nosniff
   Content-Security-Policy: "default-src 'none'; script-src 'self'; style-src 'self'; img-src 'self'; font-src 'self';"
   Cross-Origin-Opener-Policy: "same-origin"
+  Cross-Origin-Embedder-Policy: "same-origin"
+  Cross-Origin-Resource-Policy: "same-site"
 
 securedrop_venv: /opt/venvs/securedrop-app-code
 securedrop_venv_bin: "/opt/venvs/securedrop-app-code/bin"

diff --git a/molecule/testinfra/vars/prodVM.yml b/molecule/testinfra/vars/prodVM.yml
@@ -4,6 +4,8 @@ wanted_apache_headers:
   X-Content-Type-Options: nosniff
   Content-Security-Policy: "default-src 'none'; script-src 'self'; style-src 'self'; img-src 'self'; font-src 'self';"
   Cross-Origin-Opener-Policy: "same-origin"
+  Cross-Origin-Embedder-Policy: "same-origin"
+  Cross-Origin-Resource-Policy: "same-site"
 
 securedrop_venv: /opt/venvs/securedrop-app-code
 securedrop_venv_bin: "/opt/venvs/securedrop-app-code/bin"

diff --git a/molecule/testinfra/vars/qubes-staging.yml b/molecule/testinfra/vars/qubes-staging.yml
@@ -4,6 +4,8 @@ wanted_apache_headers:
   X-Content-Type-Options: nosniff
   Content-Security-Policy: "default-src 'none'; script-src 'self'; style-src 'self'; img-src 'self'; font-src 'self';"
   Cross-Origin-Opener-Policy: "same-origin"
+  Cross-Origin-Embedder-Policy: "same-origin"
+  Cross-Origin-Resource-Policy: "same-site"
 
 securedrop_venv: /opt/venvs/securedrop-app-code
 securedrop_venv_bin: "/opt/venvs/securedrop-app-code/bin"

diff --git a/molecule/testinfra/vars/staging.yml b/molecule/testinfra/vars/staging.yml
@@ -4,6 +4,8 @@ wanted_apache_headers:
   X-Content-Type-Options: nosniff
   Content-Security-Policy: "default-src 'none'; script-src 'self'; style-src 'self'; img-src 'self'; font-src 'self';"
   Cross-Origin-Opener-Policy: "same-origin"
+  Cross-Origin-Embedder-Policy: "same-origin"
+  Cross-Origin-Resource-Policy: "same-site"
 
 securedrop_venv: /opt/venvs/securedrop-app-code
 securedrop_venv_bin: /opt/venvs/securedrop-app-code/bin