[checkmk-commits] [tribe29/checkmk] 51210b: 13194 Add several security headers

Branch: refs/heads/2.0.0 Home: https://github.com/tribe29/checkmk Commit: 51210bc599b8c219fdbdc9ef395cedd5bcad7ba0 https://github.com/tribe29/checkmk/commit/51210bc599b8c219fdbdc9ef395cedd5b… Author: Maximilian Wirtz &lt;maximilian.wirtz(a)tribe29.com&gt; Date: 2022-04-07 (Thu, 07 Apr 2022) Changed paths: A .werks/13194 M omd/packages/apache-omd/skel/etc/apache/conf.d/security.conf Log Message: ----------- 13194 Add several security headers This adds the following security headers: LI:<tt>X-Frame-Options: sameorigin</tt> Only websites hosted on the same domain are allowed to include CMK as an frame. The <i>Content-Security-Policy</i> already constrains this. LI:<tt>X-XSS-Protection: 1; mode=block</tt> Enables the browser buitin XSS protection. LI:<tt>X-Permitted-Cross-Domain-Policies: none</tt> We do not ship cross-domain policies so we disable them with this header. LI:<tt>Referrer-Policy: origin-when-cross-origin</tt> Only send the origin as Referer to other sites. CMK-8555 Change-Id: Ief897a26e74274b7ad97213999b1935f87a52ca7