refactor(frontend): tighten security headers

1 files changed, 6 insertions, 3 deletions

diff --git a/subprojects/language-web/src/main/java/tools/refinery/language/web/SecurityHeadersFilter.java b/subprojects/language-web/src/main/java/tools/refinery/language/web/SecurityHeadersFilter.java
index 40dd7ee5..c41db799 100644
--- a/subprojects/language-web/src/main/java/tools/refinery/language/web/SecurityHeadersFilter.java
+++ b/subprojects/language-web/src/main/java/tools/refinery/language/web/SecurityHeadersFilter.java
@@ -10,14 +10,17 @@ public class SecurityHeadersFilter implements Filter {
         public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException,
                         ServletException {
                 if (response instanceof HttpServletResponse httpResponse) {
-                        httpResponse.setHeader("Content-Security-Policy", "default-src 'self'; " +
+                        httpResponse.setHeader("Content-Security-Policy", "default-src 'none'; " +
+                                        "script-src 'self'; " +
                                         // CodeMirror needs inline styles, see e.g.,
                                         // https://discuss.codemirror.net/t/inline-styles-and-content-security-policy/1311/2
                                         "style-src 'self' 'unsafe-inline'; " +
                                         // Use 'data:' for displaying inline SVG backgrounds.
                                         "img-src 'self' data:; " +
-                                        "object-src 'none'; " +
-                                        "base-uri 'none';");
+                                        "font-src 'self'; " +
+                                        "connect-src 'self'; " +
+                                        "manifest-src 'self'; " +
+                                        "worker-src 'self';");
                         httpResponse.setHeader("X-Content-Type-Options", "nosniff");
                         httpResponse.setHeader("X-Frame-Options", "DENY");
                         httpResponse.setHeader("Referrer-Policy", "strict-origin");