From 2c8474a478513e4865db4e8ac4ff0a80dba912ae Mon Sep 17 00:00:00 2001 From: bjdgyc Date: Tue, 11 Oct 2022 17:44:56 +0800 Subject: [PATCH] =?UTF-8?q?=E6=B7=BB=E5=8A=A0auth=E5=8F=82=E6=95=B0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- server/handler/link_base.go | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/server/handler/link_base.go b/server/handler/link_base.go index ab7c4cf..17efbb3 100644 --- a/server/handler/link_base.go +++ b/server/handler/link_base.go @@ -45,11 +45,20 @@ type macAddressList struct { func setCommonHeader(w http.ResponseWriter) { // Content-Length Date 默认已经存在 w.Header().Set("Content-Type", "text/html; charset=utf-8") - w.Header().Set("Cache-Control", "no-store") + w.Header().Set("Cache-Control", "no-store,no-cache") w.Header().Set("Pragma", "no-cache") w.Header().Set("Transfer-Encoding", "chunked") w.Header().Set("Connection", "keep-alive") - w.Header().Set("X-Frame-Options", "SAMEORIGIN") + w.Header().Set("X-Frame-Options", "deny") + w.Header().Set("X-Content-Type-Options", "nosniff") + w.Header().Set("Content-Security-Policy", "default-src 'none'") + w.Header().Set("X-Permitted-Cross-Domain-Policies", "none") + w.Header().Set("Referrer-Policy", "no-referrer") + w.Header().Set("Clear-Site-Data", "cache,cookies,storage") + w.Header().Set("Cross-Origin-Embedder-Policy", "require-corp") + w.Header().Set("Cross-Origin-Opener-Policy", "same-origin") + w.Header().Set("Cross-Origin-Resource-Policy", "same-origin") + w.Header().Set("X-XSS-Protection", "0") w.Header().Set("X-Aggregate-Auth", "1") w.Header().Set("Strict-Transport-Security", "max-age=31536000; includeSubDomains") }