GeekInTheNorth / GeekInTheNorth/Stott.Security.Optimizely
Response Headers : Make it easier to get started with adding OWASP headers
Open
@GeekInTheNorth is already working on this.
Since Jun 1, 2026.
Complete
enhancement
- Dominant language
- C#
- Stars
- 11
- Forks
- 6
- PR merge metrics
- No merged PRs in 30d
Description
With the Response Headers feature, when you edit a default header to add it, you choose "Add" and then you have to select a value even which adds multiple clicks.
Update the options for the default headers so that as soon as the Behaviour is set to "Add", the recommended value is set by default. These include:
| Header | Default |
|---|---|
| Cross-Origin-Embedder-Policy | require-corp |
| Cross-Origin-Opener-Policy | same-origin-allow-popups |
| Cross-Origin-Resource-Policy | same-origin |
| Referrer-Policy | strict-origin-when-cross-origin |
| Strict-Transport-Security | max-age=63072000; includeSubDomains; preload |
| X-Content-Type-Options | nosniff |
| X-Frame-Options | SAMEORIGIN |
| X-Xss-Protection | 0 |
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.