Patrick O'Doherty 3177e50b14

safeweb: Set Cross-Origin-Opener-Policy for browser requests (#15936) ...

Set Cross-Origin-Opener-Policy: same-origin for all browser requests to
prevent window.location manipulation by malicious origins.

Updates tailscale/corp#28480

Thank you to Triet H.M. Pham for the report.

Signed-off-by: Patrick O'Doherty <patrick@tailscale.com>

2025-05-09 13:44:36 -07:00

..

http_test.go

safeweb: add support for custom CSP (#13975)

2024-10-31 12:13:29 -07:00

http.go

safeweb: Set Cross-Origin-Opener-Policy for browser requests (#15936)

2025-05-09 13:44:36 -07:00