Sunil Mohan Adapa 110ec7d744
apache: Set CSP and other common security headers
Tests performed:

- Fonts Lato is properly and displayed.

- No <frame>, <iframe>, <video>, <audio>, <track>, <embed>, <object>, <applet>
tags are used in FreedomBox source code.

- Checked that there are no images referring to external URLs. Most of the
common images such as apps lists, system list, networks and manual show images
properly.

- Styles specified in main.css work as well as page specific styles such as in
networks. Firefox developer console shows inline styles loaded.

- JSXC is able to make XHR requests to ejabberd.

- Able to launch <a> links with _target='blank' such as in /help/support/.

- When visiting external websites, such as in donate page, Referer header is not
sent. When visiting page within FreedomBox interface, Referer header is sent
with path.

Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: Veiko Aasa <veiko17@disroot.org>
2020-06-29 10:09:36 +03:00
..