stop setting CORP header for synapse API for now

This commit is contained in:
Daniel Micay 2022-07-13 13:04:46 -04:00
parent 9b19b811ac
commit 90d542e2f4

View File

@ -120,7 +120,6 @@ http {
proxy_hide_header X-Frame-Options;
include snippets/security-headers.conf;
add_header Cross-Origin-Resource-Policy "cross-origin" always;
add_header Content-Security-Policy "font-src 'none'; manifest-src 'none'; object-src 'none'; script-src 'none'; style-src 'none'; frame-ancestors 'none'; block-all-mixed-content" always;
# obsolete and replaced with Content-Security-Policy frame-ancestors 'none'
add_header X-Frame-Options "DENY" always;