Send security headers by default, closes #279

config.default.ini

@@ -17,3 +17,6 @@ query_directory=query
 migration_path=_migration
 migration_table=_migration
 query_path=query
+
+[security]
+default_headers="X-Content-Type-Options: nosniff; X-Frame-Options: deny; Content-Security-Policy: default-src 'none'"

src/Lifecycle.php

@@ -56,6 +56,8 @@ public function start():void {
 			])
 		);
 
+		$this->defaultSecurityHeaders($config->get("security.default_headers"));
+
 		$input = new Input($_GET, $_POST, $_FILES);
 		$cookie = new CookieHandler($_COOKIE);
 
@@ -123,6 +125,18 @@ public function start():void {
 		$this->finish($response);
 	}
 
+	/**
+	 * Set some sensible security headers by default. These can be
+	 * overridden/disabled in the project's config.ini, but it makes sense
+	 * to supply them by default in order to protect user applications
+	 * without the explicit need for security configuration.
+	 */
+	public function defaultSecurityHeaders(string $headersString) {
+		foreach(explode(";", $headersString) as $header) {
+			header(trim($header));
+		}
+	}
+
 	/**
 	 * By default, PHP passes all sensitive user information around in global variables,
 	 * available for reading and modification in any code, including third party libraries.