summaryrefslogtreecommitdiff
path: root/nginx/snippets/security-headers-base.conf
AgeCommit message (Collapse)Author
2025-06-27treewide: build via nixOphestra
2022-08-25remove legacy Expect-CT headerDaniel Micay
2022-08-25Add "Origin-Agent-Cluster" headerRohan Kumar
Hint to browsers that we prefer per-origin process isolation. This disables certain unsafe features regarding cross-origin same-site resource sharing. https://web.dev/origin-agent-cluster/#limitations Specification link: https://html.spec.whatwg.org/multipage/origin.html#origin-keyed-agent-clusters This is just a hint to browsers. Depending on resource availability, they may or may not actually allocate a process. For this reason, it's not a robust security feature although it is preferable. This header needs to be active on all pages from an origin for it to work.
2021-12-10disable legacy X-XSS-Protection featureDaniel Micay
2021-06-08mark Expect-CT as largely obsoleteDaniel Micay
2021-01-23temporarily disable Trusted Types for web-installDaniel Micay
This can be enabled again when the zip library supports it.
2021-01-05add foundation for WebUSB-based install pageDaniel Micay