Add security headers to the website

[vingkan]

Headers to Add

Based on the report from securityheaders.com we have four high-priority security headers to add to our website:

• Add Content-Security-Policy header to defend against cross-site scripting attacks
• Add X-Frame-Options header to defend against clickjacking and external iframing
• Add X-Content-Type-Options header to prevent browser from MIME-sniffing content
• Add Referrer-Policy header to hide referrer information from other pages

Environments to Check

These changes should not disrupt the development or production environments. Remember to check these four methods of running the app:

Development

1. Local App with Local Server

In one terminal:

run api 9

In the other terminal:

run app 9

Then check your Cloud9 URL.

2. Local App with Production Server

run app 9 api prod

Then check your Cloud9 URL.

3. Static Local App with Local Server

In one terminal:

run api 9

In the other terminal:

run app 9 static

Then check your Cloud9 URL.

Production

4. Production App with Production Server

Submit a pull request, get it approved, and deploy the app to production.

Then check our production URL.