Add some security headers

src/site/server.js

@@ -4,6 +4,11 @@ const constants = require("../lib/constants")
 
 const passthrough = require("./passthrough")
 
+const deniedFeatures = [
+	"accelerometer", "ambient-light-sensor", "battery", "camera", "display-capture", "document-domain", "geolocation", "gyroscope",
+	"magnetometer", "microphone", "midi", "payment", "publickey-credentials-get", "sync-xhr", "usb", "xr-spatial-tracking"
+]
+
 const pinski = new Pinski({
 	port: +process.env.PORT || constants.port,
 	ip: constants.bind_ip,
@@ -12,6 +17,12 @@ const pinski = new Pinski({
 		exts: ["ttf", "woff2", "png", "jpg", "jpeg", "svg", "gif", "webmanifest", "ico"],
 		seconds: 604800
 	},
+	globalHeaders: {
+		"Content-Security-Policy": "default-src 'self'; frame-ancestors 'none'; block-all-mixed-content",
+		"Feature-Policy": deniedFeatures.map(feature => `${feature} 'none'`).join("; "),
+		"Referrer-Policy": "origin",
+		"X-Content-Type-Options": "nosniff"
+	}
 })
 
 subdirs("pug", async (err, dirs) => {