# Deliberately no X-Frame-Options or CSP frame-ancestors: HA's Webpage card and
# iframe panels frame Frigate cross-origin, and either would break them
# silently. Bind-mount this file to add your own.
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;