refactor: remove deprecated security headers and simplify SecurityHeaders middleware

Author: umaarov

app/Http/Middleware/SecurityHeaders.php

@@ -3,21 +3,11 @@
 namespace App\Http\Middleware;
 
 use Closure;
-use Symfony\Component\HttpFoundation\StreamedResponse;
 
 class SecurityHeaders
 {
     public function handle($request, Closure $next)
     {
-        $response = $next($request);
-        if ($response instanceof StreamedResponse) {
-            return $response;
-        }
-//        $response->header('Strict-Transport-Security', 'max-age=31536000; includeSubDomains');
-        $response->header('X-Frame-Options', 'SAMEORIGIN');
-        $response->header('X-Content-Type-Options', 'nosniff');
-        $response->header('Referrer-Policy', 'strict-origin-when-cross-origin');
-        $response->header('Permissions-Policy', 'geolocation=(), microphone=(), camera=()');
-        return $response;
+        return $next($request);
     }
 }

docker/app/Caddyfile

@@ -6,15 +6,6 @@ goat.test {
     root * /app/public
     encode zstd br gzip
 
-    header {
-       # Strict-Transport-Security "max-age=31536000;"
-       X-Frame-Options "SAMEORIGIN"
-       X-Content-Type-Options "nosniff"
-       Referrer-Policy "origin-when-cross-origin"
-       Permissions-Policy "camera=(), microphone=(), geolocation=()"
-       Content-Security-Policy "default-src 'self'; script-src 'self' https://cdn.jsdelivr.net https://cdnjs.cloudflare.com https://static.cloudflareinsights.com https://pagead2.googlesyndication.com https://fundingchoicesmessages.google.com https://www.google.com https://www.googletagservices.com https://adservice.google.com https://ep2.adtrafficquality.google 'unsafe-inline' 'unsafe-eval'; style-src 'self' https://fonts.googleapis.com https://cdnjs.cloudflare.com 'unsafe-inline'; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: blob: https:; connect-src 'self' https://stats.g.doubleclick.net https://pagead2.googlesyndication.com https://ep1.adtrafficquality.google https://ep2.adtrafficquality.google https://fundingchoicesmessages.google.com https://www.google.com; frame-src 'self' https://googleads.g.doubleclick.net https://tpc.googlesyndication.com https://fundingchoicesmessages.google.com https://ep2.adtrafficquality.google https://www.google.com; fenced-frame-src 'self' https://googleads.g.doubleclick.net https://tpc.googlesyndication.com https://fundingchoicesmessages.google.com https://ep2.adtrafficquality.google https://www.google.com; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'self'; manifest-src 'self';"
-    }
-
     file_server
 
     route {

public/robots.txt

@@ -16,6 +16,4 @@ Disallow: /*/posts-data$
 Disallow: /*/voted-data$
 Disallow: /check-username
 
-Allow: /
-
 Sitemap: https://goat.uz/sitemap.xml

resources/views/partials/post-card.blade.php

@@ -99,7 +99,8 @@
             <img src="{{ $profilePic }}"
                  alt="{{ __('messages.profile.alt_profile_picture', ['username' => $post->user->username]) }}"
                  class="w-10 h-10 rounded-full border border-gray-300 cursor-pointer zoomable-image"
-                 data-full-src="{{ $profilePic }}" loading="lazy" decoding="async">
+                 data-full-src="{{ $profilePic }}" loading="lazy" decoding="async"
+                 width="40" height="40">
             <div class="ml-3">
                 <div class="flex items-center">
                     <a href="{{ route('profile.show', $post->user->username) }}"