From d03d19ca38034788f866c424fe841cb20d8bc584 Mon Sep 17 00:00:00 2001
From: Tommy <contact@tommytran.io>
Date: Sun, 17 Jul 2022 22:05:24 -0400
Subject: [PATCH] Security Header Fixes

Signed-off-by: Tommy <contact@tommytran.io>
---
 firebase.json | 77 +++++++++++++++++++++++++++------------------------
 1 file changed, 41 insertions(+), 36 deletions(-)

diff --git a/firebase.json b/firebase.json
index e5fab3f..c64a9be 100644
--- a/firebase.json
+++ b/firebase.json
@@ -3,42 +3,47 @@
     "public": "public",
     "headers": [ 
       {
-        "key": "Content-Security-Policy",
-        "value": "upgrade-insecure-requests; block-all-mixed-content; form-action 'none'; frame-ancestors 'self'"
-      },
-      {
-        "key": "X-Content-Type-Options",
-        "value": "nosniff"
-      },    
-      {
-        "key": "Referrer-Policy",
-        "value": "no-referrer"
-      },   
-      {
-        "key": "Cross-Origin-Opener-Policy",
-        "value": "same-origin"
-      },   
-      {
-        "key": "Cross-Origin-Embedder-Policy",
-        "value": "require-corp"
-      },   
-      {
-        "key": "X-Frame-Options",
-        "value": "DENY"
-      },  
-      {
-        "key": "X-XSS-Protection",
-        "value": "0"
-      },  
-      {
-        "key": "Permissions-Policy",
-        "value": "accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), clipboard-read=(), clipboard-write=(), display-capture=(), document-domain=(), encrypted-media=(), fullscreen=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), magnetometer=(), microphone=(), midi=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), sync-xhr=(), usb=(), xr-spatial-tracking=()"
-      },  
-      {
-        "key": "Cross-Origin-Resource-Policy",
-        "value": "same-origin"
-      }
-    ],
+        "source": "*",
+        "headers": [
+          {
+            "key": "Content-Security-Policy",
+            "value": "upgrade-insecure-requests; block-all-mixed-content; form-action 'none'; frame-ancestors 'self'"
+          },
+          {
+            "key": "X-Content-Type-Options",
+            "value": "nosniff"
+          },    
+          {
+            "key": "Referrer-Policy",
+            "value": "no-referrer"
+          },   
+          {
+            "key": "Cross-Origin-Opener-Policy",
+            "value": "same-origin"
+          },   
+          {
+            "key": "Cross-Origin-Embedder-Policy",
+            "value": "require-corp"
+          },   
+          {
+            "key": "X-Frame-Options",
+            "value": "DENY"
+          },  
+          {
+            "key": "X-XSS-Protection",
+            "value": "0"
+          },  
+          {
+            "key": "Permissions-Policy",
+            "value": "accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), clipboard-read=(), clipboard-write=(), display-capture=(), document-domain=(), encrypted-media=(), fullscreen=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), magnetometer=(), microphone=(), midi=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), sync-xhr=(), usb=(), xr-spatial-tracking=()"
+          },  
+          {
+            "key": "Cross-Origin-Resource-Policy",
+            "value": "same-origin"
+          }
+        ]
+      }    
+     ],
     "ignore": [
       "firebase.json",
       "**/.*",