Add CSP headers

[TAINCER]

No description provided.

[lippserd]

In addition to the requested changes please:

• Remove all whitespace changes that are not related to the code you introduce.
• Regenerate the nonce if it's not an AJAX request.

[lippserd]

Why all the other headers?

[TAINCER]

I've used these headers. Since most of these are for blocking XSS, I assumed that we would want all of them. These of course are more restrictive, I can also only include Content-Security-Policy, if we don't want the rest.

[lippserd]

Since those headers are easily configureable via the web server, I would not add them here.

[TAINCER]

Could this be clarified in the docs? Possibly linking to it in the description when setting up CSP? Since this seems to be best practice.

[TAINCER]

• Regenerate the nonce if it's not an AJAX request.

I did this at first, but when column page contents are being loaded, they are not considered a XML Request $this->getRequest()->isXmlHttpRequest(); (called from Response.php). That's the main reason why I ended up persisting the nonce throughout the session.

[lippserd]

• Regenerate the nonce if it's not an AJAX request.

I did this at first, but when column page contents are being loaded, they are not considered a XML Request $this->getRequest()->isXmlHttpRequest(); (called from Response.php). That's the main reason why I ended up persisting the nonce throughout the session.

How is that possible? Do you have proof? Everything would fall apart, if they weren't AJAX requests.

[TAINCER]

I just rechecked. Now it always returns true with XHR Requests, my bad. I think I first tested this when some Javascript was still blocked by CSP.