v1.0.2

This release adds browser security headers to the ICE page. On securityheaders.com it scores A+ (previously F). The page looks and works the same as before.

What's new

• Content Security Policy. The browser only runs the scripts and styles that ICE itself puts on the page, using a one-time code that changes on every page load. Injected scripts and inline event handlers are blocked. The page can't be embedded in another site's frame, and the unlock form can only submit back to your own site.
• HTTPS enforcement (HSTS). Once a browser has visited your page over HTTPS, it will refuse to load it over plain HTTP for the next year. This is only sent when the page is served over HTTPS.
• Other headers: X-Frame-Options: DENY, X-Content-Type-Options: nosniff, Referrer-Policy: no-referrer (links out of your profile don't tell the other site where the visitor came from), a Permissions-Policy that turns off camera, microphone and location, and the Cross-Origin-Opener/Resource/Embedder-Policy headers.
• PHP version hidden. The X-Powered-By header is no longer sent.
• Stricter session cookie. Over HTTPS the cookie is named __Host-ICESESSID, and it's SameSite=Strict everywhere.

Upgrading

Replace index.php with the new one. Your config.php, profile-data.php, sensitive-data.php and photo.png are not affected.

• Anyone currently unlocked will need to enter the unlock word again, because the session cookie has a new name.
• If you changed index.php yourself and added inline <script>, <style>, style="…" or onclick="…" code, the new policy will block it. Give each <script> and <style> tag the attribute nonce="<?= $cspNonce ?>", and move inline styles and handlers into those tags.

Full changelog: v1.0.1...v1.0.2