excalidraw-box
Code Issues

feat: add security headers to caddyfile

Browse Source 
Added `X-Frame-Options`, `X-Content-Type-Options`, `Referrer-Policy`, and `Content-Security-Policy` to the Caddyfile to prevent common web vulnerabilities like XSS, MIME sniffing, and Clickjacking.
This commit is contained in:
ruinivist
2026-06-02 08:14:48 +00:00
parent d8d917d315
commit 4feb9f9b7a
1 changed files with 7 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Caddyfile
+7
View File
@@ -6,6 +6,13 @@
:80 { :80 {
encode zstd gzip encode zstd gzip
header {
X-Frame-Options "DENY"
X-Content-Type-Options "nosniff"
Referrer-Policy "strict-origin-when-cross-origin"
Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self' data:;"
}
handle /mcp { handle /mcp {
reverse_proxy 127.0.0.1:3001 reverse_proxy 127.0.0.1:3001
} }