- 'always set X-XSS-Protection "1; mode=block"'
- 'always set X-Frame-Options "SAMEORIGIN"'
- 'always set X-Content-Type-Options "nosniff"'
- - "set Content-Security-Policy: \"default-src 'self' 'unsafe-eval' 'unsafe-inline' ; style-src 'self' https://webfonts.sparkasse.de 'unsafe-inline' ; font-src 'self' data: https://webfonts.sparkasse.de ; img-src 'self' data: ;"
+ - "set Content-Security-Policy: \"default-src 'self' 'unsafe-eval' 'unsafe-inline' ; style-src 'self' https://webfonts.sparkasse.de 'unsafe-inline' ; font-src 'self' data: https://webfonts.sparkasse.de ; img-src 'self' data: ;\""
setenvif:
- 'HTTPS on X-Forwarded-Proto=https'
- 'HTTPS on HTTPS=on'