Security Headers

[jsharkey13]

Taking a look at https://securityheaders.io/, it looks like we could do a better job of adding some of these headers. I tested the following on staging, and they seem to be an improvement on nothing without requiring an extensive rewrite:

add_header Content-Security-Policy "upgrade-insecure-requests; default-src https:; script-src https: 'unsafe-inline'; style-src https: 'unsafe-inline'";
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Xss-Protection "1; mode=block" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "no-referrer-when-downgrade" always;

These are good for reference:

• the SSL only CSP header version described at the bottom of this page, which is loose but better than nothing
• an overview of the other headers can be found here

We get quite a few console errors about some external services not being able to load fonts from about:blank that should be investigated before we deployed this!