fix(headers): set Cross-Origin-Resource-Policy header for UI requests

Signed-off-by: Andrei Aaron <[email protected]>
project-zot · Jan 16, 2025 · 7320ff0 · 7320ff0
1 parent 97fd43e
commit 7320ff0
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/pkg/extensions/extension_ui.go b/pkg/extensions/extension_ui.go
@@ -40,6 +40,9 @@ func addUISecurityHeaders(h http.Handler) http.HandlerFunc { //nolint:varnamelen
 		w.Header().Set("Permissions-Policy", permissionsPolicy)
 		w.Header().Set("X-Content-Type-Options", "nosniff")
 		w.Header().Set("X-Frame-Options", "DENY")
+		w.Header().Set("Cross-Origin-Resource-Policy", "same-origin")
+		w.Header().Set("Cross-Origin-Embedder-Policy", "require-corp")
+		w.Header().Set("Cross-Origin-Opener-Policy", "same-origin")
 
 		cspDirectives := []string{
 			"default-src 'none'",