bretton.dev / coves
A community based topic aggregation platform built on atproto
Star
Fork 0
Watch

fix(caddy): make security headers and default CSP set-if-absent master

Caddy's header directive replaces upstream values, which would clobber the SvelteKit frontend's per-request nonce'd CSP (and any tightened security header) with the static 'unsafe-inline' fallback. Switch X-Content-Type- Options, X-Frame-Options, Referrer-Policy and Content-Security-Policy to '?' set-if-absent so app-owned headers pass through untouched; HSTS and -Server stay edge-only and unconditional. Drops the Turnstile path carve- out, which set-if-absent now covers generically. Also gitignore per-machine .codex/ state. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author Bretton Co-author Claude Fable 5 Date Commit b11cf4a3 Parent f5484d25
+30 -18
2 changed files