javierandClaude Fable 5.1
916df7e2f0
This commit contains the latest updates from the generic Website template, which rework the compression and localization: - Reworked the compression and localization in the Infrastructure package. (3c568e4) - Adopted the reworked compression and localization in the Website service. (08cf3e3) The template commit that only touched the root README (53676ed) was left out, as this project no longer carries that file. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
25 lines
1.7 KiB
Swift
25 lines
1.7 KiB
Swift
extension String {
|
|
/// A namespace for the security headers' default configuration values.
|
|
///
|
|
/// `Strict-Transport-Security` is intentionally absent: it is only safe over HTTPS and is "sticky" in browsers, so it stays off unless explicitly
|
|
/// configured in production.
|
|
public enum Security {
|
|
/// The default `Content-Security-Policy`.
|
|
///
|
|
/// Restricts every resource to the site's own origin (`default-src 'self'`), blocks plugins (`object-src 'none'`), pins the document
|
|
/// base URL (`base-uri 'self'`), holds form submissions to the origin (`form-action 'self'`), and forbids framing
|
|
/// (`frame-ancestors 'none'`). No inline-style exception is included, so pages must link external stylesheets.
|
|
///
|
|
/// `form-action` is named outright because it inherits from nothing: `default-src` does not cover it, however tight.
|
|
public static let contentSecurityPolicy = "default-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'"
|
|
/// The default `X-Content-Type-Options` (disables MIME sniffing).
|
|
public static let contentTypeOptions = "nosniff"
|
|
/// The default `X-Frame-Options` (forbids framing the page).
|
|
public static let frameOptions = "DENY"
|
|
/// The default `Referrer-Policy`.
|
|
public static let referrerPolicy = "strict-origin-when-cross-origin"
|
|
/// The default `Permissions-Policy` (denies access to powerful browser features a static site does not use).
|
|
public static let permissionsPolicy = "accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=()"
|
|
}
|
|
}
|