patrickandClaude Sonnet 5
18e41e5866
CI / Web-Barrierefreiheitspruefung (axe, Tastatur, Reflow, Textabstaende) (push) Canceled after 0s
CI / DMS Security-Test-Gate (AC5, Merge-Gate) (push) Canceled after 0s
CI / DMS-Modul (Lint/Build/Test/Coverage/Artefakt) (push) Canceled after 0s
CI / DMS-Modul Supply-Chain-Scan (govulncheck) (push) Canceled after 0s
CI / Core-Modul (Build/Vet/Test) (push) Canceled after 0s
Supply-Chain-Scan (Go) / govulncheck (push) Canceled after 0s
CI / Web (dms-browser) (push) Canceled after 0s
CI / Web (pdf-viewer) (push) Canceled after 0s
CI / Web (shl) (push) Canceled after 0s
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
15 lines
683 B
JavaScript
15 lines
683 B
JavaScript
// QA-15 F-16: Grundabsicherung der Antworten. Die CSP schraenkt bewusst nur
|
|
// Einbettung, Basis-URL, Formularziele und Plugins ein; script-src bleibt
|
|
// offen, weil Next.js Inline-Skripte erzeugt (strenge CSP mit Nonce waere ein
|
|
// eigenes Vorhaben).
|
|
export const securityHeaders = [
|
|
{ key: "X-Content-Type-Options", value: "nosniff" },
|
|
{ key: "X-Frame-Options", value: "DENY" },
|
|
{ key: "Referrer-Policy", value: "strict-origin-when-cross-origin" },
|
|
{ key: "Permissions-Policy", value: "camera=(), microphone=(), geolocation=()" },
|
|
{
|
|
key: "Content-Security-Policy",
|
|
value: "frame-ancestors 'none'; base-uri 'self'; object-src 'none'; form-action 'self'",
|
|
},
|
|
];
|