all repos — website @ f91b21742c5f6880e56ae96e1bd94861d217b101

My website

Send HSTS header from Fly proxy

Bun seems to eat this header otherwise
Alan Pearce alan@alanpearce.eu
Sat, 16 Sep 2023 12:58:25 +0200
commit

f91b21742c5f6880e56ae96e1bd94861d217b101

parent

d449cf9a9c53af439e23f46770d33b6c2f25a659

2 files changed, 3 insertions(+), 2 deletions(-)

jump to
M config.toml → config.toml
@@ -28,8 +28,7 @@ [extra.headers]
 cache-control = "max-age=14400"
 x-content-type-options = "nosniff"
-strict-transport-security = "max-age=31536000; includeSubdomains; preload"
-content-security-policy = "default-src 'none'; img-src 'self'; object-src 'none'; script-src 'self'; style-src 'unsafe-inline'; form-action 'none'; base-uri 'self'"
+content-security-policy = "default-src 'none'; img-src 'self'; object-src 'none'; script-src 'self'; style-src 'unsafe-inline'; form-action 'none'; base-uri 'self'; frame-ancestors https://kagi.com;"
 
 [[extra.main_menu]]
     name = "Posts"
M fly.toml → fly.toml
@@ -19,3 +19,5 @@ auto_stop_machines = false   auto_start_machines = true
   min_machines_running = 3
   processes = ["app"]
+[http_service.http_options.response.headers]
+  Strict-Transport-Security = "max-age=31536000; includeSubdomains; preload"