feat: add http security headers to caddy config

Adds X-Frame-Options, X-Content-Type-Options, and Referrer-Policy headers to all responses served by Caddy to mitigate clickjacking and MIME-type sniffing.
2026-06-05 08:20:05 +00:00
parent 01300c7061
commit 10ee988ce2
2 changed files with 10 additions and 0 deletions
@@ -6,6 +6,12 @@
 :80 {
  encode zstd gzip

+  header {
+    X-Frame-Options "DENY"
+    X-Content-Type-Options "nosniff"
+    Referrer-Policy "strict-origin-when-cross-origin"
+  }
+
  handle /mcp {
    reverse_proxy 127.0.0.1:3001
  }