cat/Kanban
Private
Public Access
1
0
Fork 0
Code Activity

Add Permissions-Policy security header

Browse Source 
Disables browser APIs not needed by the app: camera, microphone,
geolocation, payment, USB, magnetometer, gyroscope, accelerometer.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
Catherine Renelle
2026-03-09 08:15:27 -04:00
parent 827f0394ef
commit b05521add6
1 changed files with 1 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/hooks.server.ts
+1
View File
@@ -101,6 +101,7 @@ export const handle: Handle = async ({ event, resolve }) => {
response.headers.set('Referrer-Policy', 'strict-origin-when-cross-origin');
response.headers.set('Strict-Transport-Security', 'max-age=31536000; includeSubDomains');
response.headers.set('Content-Security-Policy', "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; img-src 'self' data: blob:; font-src 'self' https://fonts.gstatic.com; connect-src 'self' ws: wss:; frame-ancestors 'none'");
response.headers.set('Permissions-Policy', 'camera=(), microphone=(), geolocation=(), payment=(), usb=(), magnetometer=(), gyroscope=(), accelerometer=()');
logger.info({
method: event.request.method,