hakurei.app/nginx/snippets/security-headers-base.conf, branch mainmain website servershttp://src.rosa.moe/hakurei.app/atom/nginx/snippets/security-headers-base.conf?h=main2025-06-27T11:33:25Ztreewide: build via nix2025-06-27T11:33:25ZOphestracat@gensokyo.uk2025-06-27T11:31:45Zurn:sha1:42c21ad90626346277861471b1d6896a4e2e5058remove legacy Expect-CT header2022-08-26T03:15:08ZDaniel Micaydanielmicay@gmail.com2022-08-11T17:53:31Zurn:sha1:3991e51b7e301ba4cc4d57c88cc408198c409a61Add "Origin-Agent-Cluster" header2022-08-26T03:15:08ZRohan Kumarseirdy@seirdy.one2022-07-30T23:37:08Zurn:sha1:d6fd0df002798ba1e9e03005c352019bb4d4e736
Hint to browsers that we prefer per-origin process isolation. This
disables certain unsafe features regarding cross-origin same-site
resource sharing.
https://web.dev/origin-agent-cluster/#limitations
Specification link:
https://html.spec.whatwg.org/multipage/origin.html#origin-keyed-agent-clusters
This is just a hint to browsers. Depending on resource availability,
they may or may not actually allocate a process. For this reason, it's
not a robust security feature although it is preferable.
This header needs to be active on all pages from an origin for it to
work.
disable legacy X-XSS-Protection feature2021-12-10T09:30:34ZDaniel Micaydanielmicay@gmail.com2021-12-10T09:29:44Zurn:sha1:ebbf002a731ff536f040c77a8b03e932679b557cmark Expect-CT as largely obsolete2021-06-08T16:27:04ZDaniel Micaydanielmicay@gmail.com2021-06-08T16:27:04Zurn:sha1:2d079162d47da3faec4cd485839b0ce1e51b99cftemporarily disable Trusted Types for web-install2021-01-24T01:56:05ZDaniel Micaydanielmicay@gmail.com2021-01-24T01:56:05Zurn:sha1:548b13c09d01ecd31f7346d6156962fd6f14a8c3
This can be enabled again when the zip library supports it.
add foundation for WebUSB-based install page2021-01-05T10:34:45ZDaniel Micaydanielmicay@gmail.com2021-01-05T09:16:42Zurn:sha1:fe063f50fec346b57453f541308ad5ffa7454398