tree e73cb15b376b5f92103d70dc0d25ef988885abf1
parent e96d7fbfe7f8e4ced88e960a66fca639234929c1
author Joseph Reynolds <joseph-reynolds@charter.net> 1683906450 -0500
committer Ed Tanous <ed@tanous.net> 1687290262 +0000

Add headers Referrer-Policy and Permissions-Policy

This adds HTTP response headers Referrer-Policy and Permissions-Policy per
OWASP guidelines, with some appropriate values for BMCWeb.
https://owasp.org/www-project-secure-headers/

Policies are given for all standardized feature.  Most features are disabled
except for the following which the web application uses: usb=(self).

Tested: Yes
Via curl, confirmed headers are present.
On selected browsers, opened browser tools and confirmed browsers didn't
complain about the new headers.  Browsers checked were:
- Firefox 111.0.1 (64-bit)
- Safari Version 16.4 (18615.1.26.11.23)

Did not test access to features secured by the Permissions-Policy.
Did not test if the web application features still work.

Change-Id: I65f89d2959b0b1338c20d7222229fbdc1d720834
Signed-off-by: Joseph Reynolds <joseph-reynolds@charter.net>