finnandClaude Opus 5.5
2fb357ae77
The app set no security headers at all, and the reverse proxy sets none either. - Content-Security-Policy: default-src 'none' with 'self' only for styles, images and fonts (MAX has no JavaScript), form-action 'self' (also blocks the http:// form action downgrade), frame-ancestors 'none' and base-uri 'none'. - X-Frame-Options: DENY, X-Content-Type-Options: nosniff, Referrer-Policy: same-origin. - Strict-Transport-Security with max-age of 7 days, not in debug mode. The headers are set in after_request, so they also apply to static files, 404 and error responses. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
MAX
A small little program to manage emails.
The proxy should add X-Real-IP to get a better logging.
Setup
Requirements: Docker, Make
Start with make run-dev
Configuration
MAX_ORIGIN(required in production): The public origin of MAX, e.g.https://max.finn.st