Closed rspilker closed 3 years ago
If you decide to merge #134, I can update these test as well.
A question. Why cant this be done in before
interceptor?
This has been fixed by exposing the underlying HttpServer
instance using Jaguar.servers
getter.
By default the underlying http server adds several headers:
It is currently impossible to NOT send such an header.
If I want in my application to allow my page to be visible in an IFRAME, I can only set an illegal value for
X-Frame-Options
in theafter
. I cannot remove it.Regarding
x-xss-protection
, browsers are removing support for it, in favor of CSP headers.This feature also allows a more elegant way to centrally add a
Strict-Transport-Security
header, instead of adding it in anafter
.