I think this is more a question for @lubos
I have added these headers for my various websites including Manager.
# Enable HTTPS Strict Transport Security (HSTS) - Forces browser to use HTTPS only for that domain
Strict-Transport-Security "max-age=31536000; includeSubDomains"
# Prevent MIME sniffing - Prevents browsers guessing file types incorrectly such as treating HTML as javascript etc
X-Content-Type-Options nosniff
# Clickjacking protection - Prevents your site being embedded in iframes
X-Frame-Options SAMEORIGIN
# Referrer policy - Controls how much URL information is leaked when clicking links
Referrer-Policy "strict-origin-when-cross-origin"
# Content Security Policy - Only allow resources from your own domain
Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'"
# Experimental in browsers. Tells website to disable these functions in browser on this website
Permissions-Policy "camera=(), microphone=(), geolocation=()"
# Remove server information
-Server
I have had to modify Content-Security-Policy from “default-src ‘self’” to above in order to get Manager to load businesses.
Can you advise what is the official recommendation for HTTP Headers for Manager as there may be others that I am not aware of. Some of these settings are no doubt not relevant to Manager such as the Permissions-Policy but I am happy to keep a consistent set of headers that apply to all websites and programs that are reachable via http unless a specific header will cause a problem with that program. My biggest concern is with the CSP as that has to be configured per http application.