Make Go headers even more secure about pursuance HOT 7 OPEN

I need to review this more in-depth, but I'd say we go for feature parity with https://github.com/twitter/secureheaders - and it looks like you have that already (or nearly).

from pursuance.

@ajvb Sounds good 👍

from pursuance.

Two missing from gosecure that are in secureheaders:

X-Download-Options: noopen
X-Permitted-Cross-Domain-Policies: none

X-Download-Options - IE8 specific - http://www.nwebsec.com/HttpHeaders/SecurityHeaders/XDownloadOptions

X-Permitted-Cross-Domain-Policies - Specific to Flash and PDF's - https://www.owasp.org/index.php/OWASP_Secure_Headers_Project#xpcdp

from pursuance.

@ajvb Want to make that trivial Go function and send a PR to https://github.com/cryptag/gosecure adding the X-Download-Options: noopen header?

from pursuance.

Or add more ideas here and then implement several at once :-)

from pursuance.

:) Sounds good. I'd love to see if there are anymore I missed that are worth adding.

from pursuance.

Note to self: look into using not just https://github.com/cryptag/gosecure , but https://github.com/unrolled/secure for this purpose.

from pursuance.