From a59f37482b2ffdd2f6991f085f5abdee88b88b0a Mon Sep 17 00:00:00 2001
From: Inian <inian1234@gmail.com>
Date: Thu, 26 Jan 2023 13:08:42 +0800
Subject: [PATCH] add csp and content-type headers

csp is pretty basic for now, will beef it up later
---
 studio/next.config.js | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/studio/next.config.js b/studio/next.config.js
index 2a78210b5b7..99b4b7d2513 100644
--- a/studio/next.config.js
+++ b/studio/next.config.js
@@ -131,6 +131,19 @@ const nextConfig = {
             key: 'X-Frame-Options',
             value: 'DENY',
           },
+          {
+            key: 'X-Content-Type-Options',
+            value: 'no-sniff',
+          },
+          {
+            key: 'Content-Security-Policy',
+            value: `
+            frame-ancestors 'none';
+            upgrade-insecure-requests;
+            `
+              .replace(/\s{2,}/g, ' ')
+              .trim(),
+          },
           {
             key: 'Referrer-Policy',
             value: 'strict-origin-when-cross-origin',