From 81798be52a132c9d59e7a8e40ebd9a33acf2fb25 Mon Sep 17 00:00:00 2001
From: Ravi Lodhi <ravi.lodhi@hotwaxsystems.com>
Date: Mon, 29 Apr 2024 14:24:06 +0530
Subject: [PATCH 1/2] Improved: Added X-Frame-Options, CSP,
 strict-transport-security and Permissions-Policy headers in firebase config
 in context of soc2 compliance (#104).

---
 firebase.json | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/firebase.json b/firebase.json
index 99ff46e..402cd08 100644
--- a/firebase.json
+++ b/firebase.json
@@ -25,6 +25,24 @@
           "rewrites": [ {
             "source": "**",
             "destination": "/index.html"
+          }],
+          "headers": [ {
+            "source": "**",
+            "headers": [ {
+              "key": "X-Frame-Options",
+              "value": "SAMEORIGIN"
+            },
+            {
+              "key": "Content-Security-Policy",
+              "value": "default-src 'self';font-src 'self' data: *;script-src 'self' 'unsafe-inline' 'unsafe-eval' fonts.googleapis.com;img-src 'self' 'unsafe-inline' *.shopify.com javascript: ;style-src 'self' 'unsafe-inline' *;connect-src 'self' *"
+            },
+            {
+              "key": "strict-transport-security",
+              "value": "max-age=31536000; includeSubDomains"
+            },{
+              "key": "Permissions-Policy",
+              "value": "camera=self"
+            } ]
           }]
         }
     ]

From e5dafa9db47f2446c13a8dd25314a197d048d930 Mon Sep 17 00:00:00 2001
From: Ravi Lodhi <ravi.lodhi@hotwaxsystems.com>
Date: Wed, 20 Nov 2024 10:48:34 +0530
Subject: [PATCH 2/2] Improved: Added security headers for the prod env (#104).

---
 firebase.json | 21 +++++++++++++++++++--
 1 file changed, 19 insertions(+), 2 deletions(-)

diff --git a/firebase.json b/firebase.json
index 402cd08..85bf405 100644
--- a/firebase.json
+++ b/firebase.json
@@ -11,8 +11,25 @@
           "rewrites": [ {
             "source": "**",
             "destination": "/index.html"
-          } ]
-
+          } ],
+          "headers": [ {
+            "source": "**",
+            "headers": [ {
+              "key": "X-Frame-Options",
+              "value": "SAMEORIGIN"
+            },
+            {
+              "key": "Content-Security-Policy",
+              "value": "default-src 'self';font-src 'self' data: *;script-src 'self' 'unsafe-inline' 'unsafe-eval' fonts.googleapis.com;img-src 'self' 'unsafe-inline' *.shopify.com javascript: ;style-src 'self' 'unsafe-inline' *;connect-src 'self' *"
+            },
+            {
+              "key": "strict-transport-security",
+              "value": "max-age=31536000; includeSubDomains"
+            },{
+              "key": "Permissions-Policy",
+              "value": "camera=self"
+            } ]
+          }]
         },
         {
           "target": "dev",