[webconsole] security hardening headers (closes #1464)

Signed-off-by: r4sas <[email protected]>
PurpleI2P · Apr 10, 2020 · b3974cb · b3974cb
1 parent b7c206c
commit b3974cb
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/daemon/HTTPServer.cpp b/daemon/HTTPServer.cpp
@@ -1141,6 +1141,8 @@ namespace http {
 	void HTTPConnection::SendReply (HTTPRes& reply, std::string& content)
 	{
 		reply.add_header("X-Frame-Options", "SAMEORIGIN");
+		reply.add_header("X-Content-Type-Options", "nosniff");
+		reply.add_header("X-XSS-Protection", "1; mode=block");
 		reply.add_header("Content-Type", "text/html");
 		reply.body = content;