feat(headers): explicit directives

Baroshem / nuxt-security

🛡 Automatically configure your app to follow OWASP security patterns and principles by using HTTP Headers and Middleware

MIT License

737 stars 56 forks source link

Types of changes

[ ] Bug fix (a non-breaking change which fixes an issue)
[x] New feature (a non-breaking change which adds functionality)
[ ] Breaking change (fix or feature that would cause existing functionality to change)

Description

This PR modifies the default settings of CSP directives with a default value of default-src 'none'. This conforms to Mozilla recommendations and increases the security score on the Mozilla Observatory.

Checklist:

[x] My change requires a change to the documentation.
[x] I have updated the documentation accordingly.
[x] I have added tests to cover my changes (if not applicable, please state why)