Added X-Frame-Options and CSP (#1690)

2025-02-28 11:06:27 +00:00
parent e1db12b8ba
commit 5164935f9c
1 changed files with 7 additions and 0 deletions
@@ -25,6 +25,13 @@ export default function handleRequest(
  responseHeaders: Headers,
  remixContext: EntryContext
 ) {
+  const url = new URL(request.url);
+
+  if (url.pathname.startsWith("/login")) {
+    responseHeaders.set("X-Frame-Options", "SAMEORIGIN");
+    responseHeaders.set("Content-Security-Policy", "frame-ancestors 'self'");
+  }
+
  const acceptLanguage = request.headers.get("accept-language");
  const locales = parseAcceptLanguage(acceptLanguage, {
    validate: Intl.DateTimeFormat.supportedLocalesOf,