Block
Available
Free
Security headers
- Version
- 0.1.0
- Database part
- No
The contract
Takes every response the app sends. Returns it with one approved set of browser security headers, including the Content Security Policy.
Settings
| Name | What it does |
|---|---|
| supabaseUrl | Lets the browser reach that one Supabase project for data, sign in and storage. |
| sentryDsn | Lets the browser send error reports to that Sentry host. |
| extraSources | Adds explicit https or wss origins to named directives. |
| inlineStyles | Allow or deny. Defaults to allow, which Radix and sonner need. |
| mode | Enforce or report-only. Defaults to enforce. |
| indexable | Set to false to tell search engines to stay away. |
Requires
This block works on its own.
Live demo
The block sends 7 headers for app.example.org. This runs the same code your app would run.
- X-Content-Type-Options
- nosniff
- Referrer-Policy
- strict-origin-when-cross-origin
- Permissions-Policy
- camera=(), microphone=(), geolocation=(), payment=(), usb=(), serial=(), midi=(), accelerometer=(), gyroscope=(), magnetometer=()
- X-Frame-Options
- DENY
- Strict-Transport-Security
- max-age=31536000; includeSubDomains
- X-Robots-Tag
- noindex, nofollow, noarchive
- Content-Security-Policy
- default-src 'self'; script-src 'self' 'nonce-demo-nonce'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https://your-project.supabase.co; font-src 'self' data:; connect-src 'self' https://your-project.supabase.co wss://your-project.supabase.co; frame-src 'none'; media-src 'self' blob:; worker-src 'self' blob:; manifest-src 'self'; form-action 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'