Security policy for the reverse proxy

[psavva]

Do not allow the browser to render the page inside an frame or iframe and avoid clickjacking
Allow iframes only from the same origin
Disable content-type sniffing
Cross-site scripting (XSS) filter
Enable HSTS(HTTP Strict Transport Security)
Do not leak server info such as the nginx version number in error pages or the server headers
Content Security Policy (CSP)

• Note that this policy is not optimal. It since the indexer uses inline scripts, we have to allow "unsafe-inline" which can be imporoved upon by removing any inline scripts, either using a nonce a script hash or external file. It's however much safer than not doing anything at all.

[dangershony]

It since the indexer uses inline scripts

You mean explorer?

This mean the proxy will be limited for other uses like wallet?

[psavva]

@dangershony The indexer UI has inline scrips which was being blocked.

[psavva]

@dangershony

https://github.com/block-core/blockcore-indexer/blob/bb7572bd87487daca7864daa2528f0970b7f6720/src/Blockcore.Indexer/wwwroot/index.html#L34C8-L34C8

[dangershony]

I am fine with this @sondreb any comments? if not please merge