restrict browser permissions on API responses

2026-09-06 18:25:05 +03:00
parent 7fe7701cec
commit 404bfc4972
3 changed files with 8 additions and 0 deletions
@@ -627,6 +627,7 @@ function json(res, code, body) {
    'Cache-Control': 'no-store',
    'X-Content-Type-Options': 'nosniff',
    'Referrer-Policy': 'no-referrer',
+    'Permissions-Policy': 'camera=(), microphone=(), geolocation=()',
  };
  const origin = res.__ihaleistCorsOrigin;
  if (CORS_ORIGINS.length) headers.Vary = 'Origin';