HTTP header improvements (#294)

[akkoma] / lib / pleroma / web / plugs / http_security_plug.ex

diff --git a/lib/pleroma/web/plugs/http_security_plug.ex b/lib/pleroma/web/plugs/http_security_plug.ex
index 43b075447e71cb37858f88243baf4b44aa6c45fe..47874a980147561439e1894a4bcddd2134edc4b3 100644 (file)
--- a/lib/pleroma/web/plugs/http_security_plug.ex
+++ b/lib/pleroma/web/plugs/http_security_plug.ex
@@ -42,12 +42,11 @@ defmodule Pleroma.Web.Plugs.HTTPSecurityPlug do
     custom_http_frontend_headers = custom_http_frontend_headers()
 
     headers = [
-      {"x-xss-protection", "1; mode=block"},
+      {"x-xss-protection", "0"},
       {"x-permitted-cross-domain-policies", "none"},
       {"x-frame-options", "DENY"},
       {"x-content-type-options", "nosniff"},
       {"referrer-policy", referrer_policy},
-      {"x-download-options", "noopen"},
       {"content-security-policy", csp_string()},
       {"permissions-policy", "interest-cohort=()"}
     ]
@@ -76,7 +75,7 @@ defmodule Pleroma.Web.Plugs.HTTPSecurityPlug do
 
   static_csp_rules = [
     "default-src 'none'",
-    "base-uri 'self'",
+    "base-uri 'none'",
     "frame-ancestors 'none'",
     "style-src 'self' 'unsafe-inline'",
     "font-src 'self'",
@@ -104,12 +103,13 @@ defmodule Pleroma.Web.Plugs.HTTPSecurityPlug do
         {[img_src, " https:"], [media_src, " https:"]}
       end
 
-    connect_src = if Config.get([:media_proxy, :enabled]) do
-      sources = build_csp_multimedia_source_list()
-      ["connect-src 'self' blob: ", static_url, ?\s, websocket_url, ?\s, sources]
-    else
-      ["connect-src 'self' blob: ", static_url, ?\s, websocket_url]
-    end
+    connect_src =
+      if Config.get([:media_proxy, :enabled]) do
+        sources = build_csp_multimedia_source_list()
+        ["connect-src 'self' blob: ", static_url, ?\s, websocket_url, ?\s, sources]
+      else
+        ["connect-src 'self' blob: ", static_url, ?\s, websocket_url]
+      end
 
     script_src =
       if Config.get(:env) == :dev do
@@ -236,11 +236,9 @@ your instance and your users via malicious posts:
 
   defp maybe_send_sts_header(conn, true) do
     max_age_sts = Config.get([:http_security, :sts_max_age])
-    max_age_ct = Config.get([:http_security, :ct_max_age])
 
     merge_resp_headers(conn, [
-      {"strict-transport-security", "max-age=#{max_age_sts}; includeSubDomains"},
-      {"expect-ct", "enforce, max-age=#{max_age_ct}"}
+      {"strict-transport-security", "max-age=#{max_age_sts}; includeSubDomains; preload"}
     ])
   end