mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-09 12:17:13 +00:00
kevinveenbirkenbachandClaude Opus 4.7
e746368c20
Browser vendors deprecated X-Frame-Options/X-XSS-Protection/X-Download-Options/ X-Permitted-Cross-Domain-Policies; CSP (rendered from each role's meta/server.yml via build_csp_header) is the modern replacement. To make the SPOT actually win against upstream apps (e.g. Keycloak/Quarkus still emits X-Frame-Options), the proxy now hides those headers on every location type. Includes a fail-loud lint that catches any future add_header / Header set/add re-introduction in .conf / .conf.j2 / .htaccess / .j2 / .jinja / .tmpl files. - sys-svc-proxy: new upstream_strips.conf.j2 partial bundles HSTS + the 4 deprecated header strips; included in html/media/ws/upload + web-svc-logout + web-app-oauth2-proxy locations (nginx array-replacement inheritance forces per-location placement) - web-app-keycloak: meta/server.yml frame-ancestors allows the primary-domain wildcard with the dynamic TLS protocol so dashboard silent-check-sso iframe loads cleanly - web-app-dashboard/playwright: drop isOidcSilentCheckNoise — root cause is now fixed, no noise filter needed - web-app-dashboard/nginx + web-app-nextcloud/nginx: remove the deprecated add_header lines themselves - tests + docs: new lint registers `deprecated-http-header` suppression rule Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Documentation 📝
This directory contains the repository documentation published for Infinito.Nexus. Its scope is contributor guidance, agent instructions, operational guides, requirements, and security guidance across the project.