Add a web.frontend.SecurityHeaders API to cover all of: X-Content-Type-Options ✅, Content-Security-Policy, X-Frame-Options, Referrer-Policy and Permissions-Policy, e.g. as follows:
[x] Check how to add easy report-only modes for csp and permissions
[x] Check how a nonce-notation would work
[ ] Make framing and referrers accessible via enums
[x] Check what could be sensible defaults?
[x] ...and if we can find defaults, add these to the frontend and then make them customizable via $frontend->security()->csp(...) instead of always having to add these manually
Idea
Add a
web.frontend.SecurityHeaders
API to cover all of: X-Content-Type-Options ✅, Content-Security-Policy, X-Frame-Options, Referrer-Policy and Permissions-Policy, e.g. as follows:nonce
-notation would work$frontend->security()->csp(...)
instead of always having to add these manuallySee https://securityheaders.com/?q=https%3A%2F%2Fdialog.sloppy.zone%2F
Inspired by