To enhance system security and ensure our customers can use our service with confidence, Shifter has added and updated security-related response headers. We have strengthened browser-side security controls by adding the following settings.
- Content-Security-Policy (CSP): Allows only content from trusted sources to be executed, reducing the risk of attacks such as cross-site scripting (XSS).
- Referrer-Policy: Restricts the scope of referrer information sent when redirecting to external sites, thereby enhancing privacy protection.
- X-Content-Type-Options: Prevents browsers from misidentifying MIME types, thereby preventing the execution of malicious files.
- Strict-Transport-Security (HSTS): Enforces HTTPS connections on browsers to ensure secure communication.
- Cross-Origin Policies: Controls over resource sharing and window operations between different origins have been optimized.
Configuration details of the assigned security headers
content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' blob: https:; style-src 'self' 'unsafe-inline' https:; font-src 'self' data: https:; frame-src 'self' https:; img-src 'self' data: https:; connect-src 'self' https:; frame-ancestors *;
referrer-policy: strict-origin-when-cross-origin
x-content-type-options: nosniff
strict-transport-security: max-age=600
cross-origin-embedder-policy: unsafe-none
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin