make security headers less strict, fixing external auth

NielsPilgaard · Aug 2, 2024 · b0275bc · b0275bc
1 parent 054abab
commit b0275bc
Showing 1 changed file with 6 additions and 1 deletion.
diff --git a/src/web/Jordnaer/Program.cs b/src/web/Jordnaer/Program.cs
@@ -92,7 +92,12 @@
 
 var app = builder.Build();
 
-app.UseSecurityHeaders(policies => policies.AddDefaultSecurityHeaders());
+app.UseSecurityHeaders(policies => policies.AddFrameOptionsDeny()
+										   .AddXssProtectionBlock()
+										   .AddContentTypeOptionsNoSniff()
+										   .AddStrictTransportSecurityMaxAge()
+										   .AddReferrerPolicyStrictOriginWhenCrossOrigin()
+										   .RemoveServerHeader());
 
 if (app.Environment.IsDevelopment())
 {