msfjarvis
/
msfjarvis.dev
mirror of https://github.com/msfjarvis/msfjarvis.dev.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

workers-site: drop Feature-Policy header [staging] [deploy] 

Signed-off-by: Harsh Shandilya <me@msfjarvis.dev>
This commit is contained in:
Harsh Shandilya 2020-12-19 12:22:19 +05:30
parent 454086f350
commit 5f60f6ff2c
1 changed files with 0 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
workers-site/src/handler.ts
View File

@ -5,7 +5,6 @@ const APS_SLUG = 'Android-Password-Store/Android-Password-Store'
const GITHUB_URL = `https://github.com/${GITHUB_USERNAME}`
const APS_GITHUB_URL = `https://github.com/${APS_SLUG}`
const CSP_POLICY = "base-uri 'self'; connect-src 'self'; default-src 'self'; frame-ancestors 'none'; frame-src asciinema.org github.com platform.twitter.com; font-src 'self' fonts.gstatic.com; img-src 'self' data: gfycat.com imgur.com *.imgur.com syndication.twitter.com; object-src 'none'; script-src 'self' asciinema.org cdn.jsdelivr.net platform.twitter.com unpkg.com 'nonce-MZSWC5DVOJSS23TPNZRWKCQ='; style-src 'self' cdn.jsdelivr.net fonts.googleapis.com;";
const FEATURE_POLICY = "accelerometer 'none'; autoplay 'none';camera 'none';encrypted-media 'none'; geolocation 'none';gyroscope 'none';magnetometer 'none';microphone 'none';midi 'none';payment 'none';picture-in-picture 'none';sync-xhr 'none';usb 'none'"
const PERMISSIONS_POLICY = "accelerometer=(), autoplay=(), camera=(), encrypted-media=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), midi=(), payment=(), picture-in-picture=(), sync-xhr=(), usb=()"
export async function handleRequest(event: FetchEvent): Promise<Response> {
@ -22,7 +21,6 @@ async function getPageFromKV(event: FetchEvent): Promise<Response> {
response.headers.set('X-Frame-Options', 'DENY')
response.headers.set('Referrer-Policy', 'no-referrer-when-downgrade')
response.headers.set('Content-Security-Policy', CSP_POLICY)
response.headers.set('Feature-Policy', FEATURE_POLICY)
response.headers.set('Permissions-Policy', PERMISSIONS_POLICY)
return response
} catch (e) {