Merge remote-tracking branch 'per/http-headers' into v2

main.go

@@ -125,13 +125,15 @@ func main() {
 		},
 	}))
 
-	// Global headers (from GotHub)
+	// Global HTTP headers
 	server.Use(func(c *fiber.Ctx) error {
 		c.Set("X-Frame-Options", "SAMEORIGIN")
-		c.Set("X-XSS-Protection", "1; mode=block")
 		c.Set("X-Content-Type-Options", "nosniff")
 		c.Set("Referrer-Policy", "no-referrer")
 		c.Set("Strict-Transport-Security", "max-age=31536000; includeSubDomains; preload")
+		// -- Allowing inline styles may be simpler and avoid breakage, but you lose a lot of the protection that CSP provides
+		// src: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/style-src#unsafe_inline_styles
+		c.Set("Content-Security-Policy", "default-src 'none'; script-src 'self' 'sha256-hyWmaJx4D/wwnSlHuylUcUEAHy4waDmxU5jgvi3ilCs='; style-src 'self' 'unsafe-inline'; img-src 'self' https:; connect-src 'self'; frame-ancestors 'self'; object-src 'none'")
 
 		return c.Next()
 	})

views/layout.jet.html

@@ -7,8 +7,6 @@
     <meta charset="UTF-8" />
     <meta name="description" content="View this page on PixivFE." />
     <meta name="viewport" content="width=device-width, initial-scale=1" />
-    <meta http-equiv="Content-Security-Policy" content="script-src 'self' 'unsafe-inline'" />
-    <meta name="referrer" content="no-referrer, same-origin" />
     <link href="/css/style.css" rel="stylesheet" />
     <script src="/js/htmx@1.9.10.min.js" integrity="sha384-D1Kt99CQMDuVetoL1lrYwg5t+9QdHe7NLX/SoJYkXDFfX37iInKRy5xLSi8nO7UC"></script>