echo: disable old security headers

1 files changed, 8 insertions, 2 deletions

diff --git a/echo/middleware/strict_secure.go b/echo/middleware/strict_secure.go
index 0b61b92..2705724 100644
--- a/echo/middleware/strict_secure.go
+++ b/echo/middleware/strict_secure.go
@@ -11,12 +11,18 @@ import (
 // the legacy nginx proxy defaults.
 func StrictSecure() echo.MiddlewareFunc {
         return middleware.SecureWithConfig(middleware.SecureConfig{
-                XFrameOptions:         "SAMEORIGIN",
                 ContentTypeNosniff:    "nosniff",
-                XSSProtection:         "1; mode=block",
                 ReferrerPolicy:        "same-origin",
                 HSTSExcludeSubdomains: false,
                 HSTSPreloadEnabled:    true,
                 HSTSMaxAge:            gltime.ToSeconds(2 * gltime.Year),
+
+                // No longer used, subsumed by the frame-source option of CSP:
+                // https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options
+                XFrameOptions: "",
+
+                // Should never be used according to:
+                // https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection
+                XSSProtection: "",
         })
 }