Merge pull request #61 from codeforjapan/fix/secure-header

セキュリティリスクを低減させるレスポンスヘッダーを入れる
codeforjapan · Mar 10, 2025 · 6044a64 · 6044a64
2 parents 35d21e6 + 91076a6
commit 6044a64
Showing 1 changed file with 10 additions and 0 deletions.
diff --git a/app/entry.server.tsx b/app/entry.server.tsx
@@ -15,5 +15,15 @@ export default async function handleRequest(
     routerContext,
     loadContext,
   );
+
+  response.headers.set(
+    "Strict-Transport-Security",
+    "max-age=63072000; includeSubDomains; preload",
+  );
+  response.headers.set("Referrer-Policy", "strict-origin-when-cross-origin");
+  response.headers.set("X-Content-Type-Options", "nosniff");
+  response.headers.set("X-Frame-Options", "DENY");
+  response.headers.set("X-Permitted-Cross-Domain-Policies", "none");
+
   return response;
 }