Add missing headers

[toderash]

Add headers:

• Content-Security-Policy
• X-Frame-Options
• X-Content-Type-Options
• Referrer-Policy Permissions-Policy
• Strict-Transport-Security

https://securityheaders.com/?q=fair.pm&followRedirects=on

Calling this a bug rather than an enhancement.

[chuckadams]

I can add these to the Caddy config in the dockerize branch, but I'm not entirely sure what the content should be:

• Content-Security-Policy: this is the big one, and I'll need someone to give me a CSP that makes sense for WP and our site in particular.
• X-Frame-Options: SAMEORIGIN should be fine
• X-Content-Type-Options: nosniff is common sense
• Referrer-Policy: strict-origin-when-cross-origin is the default browser behavior. I suppose we could make it explicit.
• Permissions-Policy is a chrome-specific thing I'm not up to speed on
• Strict-Transport-Security probably should be 30 days, but frankly it's kind of nitpicky and should be low or even entirely off in dev, because clearing the HSTS cache is fiddly and arcane. Open question though, should we add includeSubDomains?

[ramseyp]

A basic one from seeing what's in our source code:

Content-Security-Policy: 
  default-src 'self';
  script-src 'self' 'unsafe-inline';
  style-src 'self' 'unsafe-inline';
  img-src 'self' https://github.com https://raw.githubusercontent.com data:;
  font-src 'self' data:;
  connect-src 'self';
  frame-ancestors 'none';
  base-uri 'self';
  form-action 'self';

If it helps flesh it out more, here's a more detailed CSP from an unnamed site showing a fairly tight policy. What's allowed to run from where, basically:

Content-Security-Policy:
  default-src
    'self'
    *.pcdn.co
    *.dpress.com
    *.dtpress.com
    cdn.rawgit.com
    code.jquery.com
    platform.twitter.com
    api-6fce660a.duosecurity.com
    cdn.datatables.net;
  
  script-src
    'self'
    *.pcdn.co
    *.dpress.com
    *.dtpress.com
    *.cloudfront.net
    *.bitmovin.com
    cdn.rawgit.com
    code.jquery.com
    platform.twitter.com
    cdnjs.cloudflare.com
    'unsafe-inline'
    'unsafe-eval';
  
  style-src
    'self'
    *.pcdn.co
    *.dpress.com
    *.dtpress.com
    *.bitmovin.com
    cdn.rawgit.com
    code.jquery.com
    cdnjs.cloudflare.com
    'unsafe-inline';
  
  img-src
    *
    data:;
  
  font-src
    *
    data:;
  
  frame-src
    'self'
    *.dpress.com
    *.dtpress.com
    *.pcdn.co
    *.cloudfront.net
    platform.twitter.com
    *.youtube.com
    *.vimeo.com;
  
  connect-src
    'self'
    *.pcdn.co
    *.dpress.com
    *.dtpress.com
    *.bitmovin.com
    cdn.rawgit.com
    d.akamaized.net
    code.jquery.com
    bam.nr-data.net;
  
  media-src
    'self'
    *.pcdn.co
    *.dpress.com
    *.dtpress.com
    dispress-vh.akamaihd.net
    d.akamaized.net
    cdn.rawgit.com
    blob:;
  
  worker-src
    'self'
    *.pcdn.co
    *.dpress.com
    *.dtpress.com
    blob: