The app set no security headers at all, and the reverse proxy sets none
either.
- Content-Security-Policy: default-src 'none' with 'self' only for
styles, images and fonts (MAX has no JavaScript), form-action 'self'
(also blocks the http:// form action downgrade), frame-ancestors
'none' and base-uri 'none'.
- X-Frame-Options: DENY, X-Content-Type-Options: nosniff,
Referrer-Policy: same-origin.
- Strict-Transport-Security with max-age of 7 days, not in debug mode.
The headers are set in after_request, so they also apply to static
files, 404 and error responses.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
finnandClaude Opus 5.5
2fb357ae77