Fix missing default headers

diff --git a/config/application.rb b/config/application.rb
index 92aecc8fc11502cc46529a91d148adf1839ccf93..552f4ec1179a124d50fe86a72f2c33f96bc04931 100644 (file)
--- a/config/application.rb
+++ b/config/application.rb
@@ -38,7 +38,9 @@ module Mastodon
     end
 
     config.action_dispatch.default_headers = {
-      'X-Frame-Options' => 'DENY'
+      'X-Frame-Options' => 'DENY',
+      'X-Content-Type-Options' => 'nosniff',
+      'X-XSS-Protection' => '1; mode=block'
     }
   end
 end