Remove content security header upgrade-insecure-requests which breaks http only server configs

2026-01-27 09:49:09 +01:00 · 2023-07-27 09:21:03 +02:00
parent 640f136365
commit f6b3d969a1
1 changed files with 0 additions and 1 deletions
--- a/scm-webapp/src/main/java/sonia/scm/filter/SecurityHeadersFilter.java
+++ b/scm-webapp/src/main/java/sonia/scm/filter/SecurityHeadersFilter.java
@@ -44,7 +44,6 @@ public class SecurityHeadersFilter extends HttpFilter {
        "form-action 'self'; " +
        "object-src 'none'; " +
        "frame-ancestors 'none'; " +
-        "upgrade-insecure-requests; " +
        "block-all-mixed-content"
    );
    response.setHeader("Permissions-Policy",