Joel Brock
7bc83a782d
- _headers: add CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, HSTS, COOP, CORP, COEP - sw.js: gate fetch handler to GET + http(s) + same-origin; return 504 on offline non-document failures; bump cache to v11 - app.js: validate every field of the localStorage save (allowlist species, clamp stats, coerce age, reject oversized payloads, strip HTML-relevant chars from name); apply same sanitizer to rename input
18 lines
942 B
Plaintext
18 lines
942 B
Plaintext
/*
|
|
Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data:; connect-src 'self'; manifest-src 'self'; worker-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'; object-src 'none'; upgrade-insecure-requests
|
|
X-Frame-Options: DENY
|
|
X-Content-Type-Options: nosniff
|
|
Referrer-Policy: no-referrer
|
|
Permissions-Policy: accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=(), interest-cohort=()
|
|
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
|
|
Cross-Origin-Opener-Policy: same-origin
|
|
Cross-Origin-Resource-Policy: same-origin
|
|
Cross-Origin-Embedder-Policy: credentialless
|
|
|
|
/sw.js
|
|
Cache-Control: no-cache, no-store, must-revalidate
|
|
Service-Worker-Allowed: /
|
|
|
|
/manifest.json
|
|
Cache-Control: no-cache
|