asseeninmovies: minimal security headers (X-Content-Type-Options nosniff, X-Frame-Options SAMEORIGIN, Referrer-Policy strict-origin-when-cross-origin, Permissions-Policy default-deny on geo/mic/camera/payment). 52/52.

cc62349ffd27ed6bd027bef93db32d3ca2b06b2a · 2026-05-13 04:11:34 -0700 · SteveStudio2

Files touched

M server.js

Diff

commit cc62349ffd27ed6bd027bef93db32d3ca2b06b2a
Author: SteveStudio2 <stevestudio2@SteveStacStudio.lan>
Date:   Wed May 13 04:11:34 2026 -0700

    asseeninmovies: minimal security headers (X-Content-Type-Options nosniff, X-Frame-Options SAMEORIGIN, Referrer-Policy strict-origin-when-cross-origin, Permissions-Policy default-deny on geo/mic/camera/payment). 52/52.
---
 server.js | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/server.js b/server.js
index 12a2302..446f64b 100644
--- a/server.js
+++ b/server.js
@@ -45,6 +45,17 @@ app.set('trust proxy', 1);
 // gzip compression for all responses ≥ 1KB. Big leverage on JSON-LD-heavy
 // HTML pages — /movies and /spotted carry full ItemList payloads now.
 app.use(compression({ threshold: 1024 }));
+// Minimal security headers — sod has the full helmet suite but asim has
+// the Big Red iframe widget which complicates CSP, so we set the
+// uncontroversial ones manually: clickjacking, MIME-sniffing, referrer
+// leak, and permissions-policy default deny.
+app.use((req, res, next) => {
+  res.setHeader('X-Content-Type-Options', 'nosniff');
+  res.setHeader('X-Frame-Options', 'SAMEORIGIN');
+  res.setHeader('Referrer-Policy', 'strict-origin-when-cross-origin');
+  res.setHeader('Permissions-Policy', 'geolocation=(), microphone=(), camera=(), payment=()');
+  next();
+});
 app.use(express.json({ limit: '2mb' }));
 app.disable('x-powered-by');

← e810f9c asseeninmovies: home cta-row — add SPOTTED browse-link along · back to AsSeenInMovies · asseeninmovies: pin engines.node>=20 in package.json. Mirror 999138e →