Repository navigation
fix(web): add baseline security response headers - #1934
Merged
Merged
Conversation
|
Paragon Review Skipped Hi @richiemcilroy! Your Polarity credit balance is insufficient to complete this review. Please visit https://app.paragon.run to finish your review. |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
![tembo[bot]](https://avatars.githubusercontent.com/in/1223475?s=60&v=4){kind=small}
Member
Author
|
@greptileai please review the PR |
Member
Author
|
@greptileai please review the PR |
Member
Author
|
@greptileai please review the PR |
Contributor
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
![capy-ai[bot]](https://avatars.githubusercontent.com/in/1915919?s=60&v=4){kind=small}
Member
Author
|
@greptileai review |
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds baseline security response headers to the web app:
X-Content-Type-Options: nosniffandX-DNS-Prefetch-Control: offon every route, andReferrer-Policy: strict-origin-when-cross-originon every route except/api/auth/*, which sets its ownno-referreron the SSO redirect./embedand the share pages stay frameable, and anti-framing is handled inproxy.tsby fix(web): require same-site requests for cookie-authenticated writes and set frame headers on app pages #2997.strict-origin-when-cross-originis already the browser default, so OAuth (Google, WorkOS), Stripe redirects, the Loom import (which setsno-referreron its own requests) and analytics behave the same.
This PR appears safe to merge.Summary
Adds baseline response headers in
apps/web/next.config.mjs:No new actionable issues were found. The previous threads have no supplied comment numbers, so they receive no numbered entries above. The DNS-prefetch finding is fixed.
richiemcilroyintentionally left framing protection toproxy.tsand #2997 so share pages remain frameable.richiemcilroyalso removed HSTS from this PR because Vercel already sends it on cap.so.Reviews (5) · Last reviewed commit: "fix(web): limit baseline headers to nosn..." · Reviewed by Greptile