Kristoffer Dalby 0567cb6da3 app: add security headers middleware ...

X-Frame-Options: DENY and frame-ancestors 'none' stop clickjacking
of OIDC, register-confirm, and debug HTML pages. nosniff and no-referrer
are cheap defence-in-depth for the same surfaces.

Updates #3157

2026-04-17 16:31:49 +01:00

718 B

Raw Blame History

View Raw