tree f0f628938a887351a41e03130331e02e39e2e95f
parent 9dcfe8c1ca70f8ff260aa5613f787d5fa3e7c45d
author Ed Tanous <edtanous@google.com> 1686787907 -0700
committer Ed Tanous <ed@tanous.net> 1688053764 +0000

Update to owasp headers

Change the Cache-Control header to what owasp recommends.
Remove the X-XSS-Protection.  This has been removed from Chrome, and is
unimplemented in other browsers[1].

Add:
X-Permitted-Cross-Domain-Policies
Clear-Site-Data
Cross-Origin-Embedder-Policy
Cross-Origin-Opener-Policy
Cross-Origin-Resource-Policy

And set them to the OWASP recommended values.

Tested: The OWASP Venom test suite now passes more tests.

[1] https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection

Change-Id: I2860041c1037f47bb85a6444cec66960d0aa55f9
Signed-off-by: Ed Tanous <edtanous@google.com>