Change Details

Cashtab would benefit from some more strict security headers. Strict-Transport-Security - allows only https X-Frame-Options "DENY" -- prevent cashtab appearing in a frame, prevent clickjacking attacks X-Content-Type-Options -- ref https://scotthelme.co.uk/hardening-your-http-response-headers/#x-content-type-options Referrer-Policy -- only showthe origin, for example we don't want to pass URL referrer info if it had tx params Permissions-Policy -- do not allow camera use from another site

T3395 Cashtab would benefit from some more strict security headers. Strict-Transport-Security - allows only https X-Frame-Options "DENY" -- prevent cashtab appearing in a frame, prevent clickjacking attacks X-Content-Type-Options -- ref https://scotthelme.co.uk/hardening-your-http-response-headers/#x-content-type-options Referrer-Policy -- only showthe origin, for example we don't want to pass URL referrer info if it had tx params Permissions-Policy -- do not allow camera use from another site Also will add a CSP header, but this one is more complicated and risks breaking things -- so should be handled separately

T3395 Cashtab would benefit from some more strict security headers. Strict-Transport-Security - allows only https X-Frame-Options "DENY" -- prevent cashtab appearing in a frame, prevent clickjacking attacks X-Content-Type-Options -- ref https://scotthelme.co.uk/hardening-your-http-response-headers/#x-content-type-options Referrer-Policy -- only showthe origin, for example we don't want to pass URL referrer info if it had tx params Permissions-Policy -- do not allow camera use from another site Also will add a CSP header, but this one is more complicated and risks breaking things -- so should be handled separately