Release 0.5.1

src/hooks.server.ts

@@ -14,6 +14,7 @@ const publicPaths = new Set([
 
 export const handle: Handle = async ({ event, resolve }) => {
 	const presentationPath = event.url.pathname.startsWith('/heinzlive/');
+	const presentationTestPath = /^\/fundus\/[^/]+\/praesentation(?:\/|$)/.test(event.url.pathname);
 	const token = event.cookies.get(SESSION_COOKIE);
 	event.locals.user = getSessionUser(token);
 	if (token && !event.locals.user) deleteSession(event.cookies);
@@ -26,9 +27,13 @@ export const handle: Handle = async ({ event, resolve }) => {
 	response.headers.set('Referrer-Policy', 'same-origin');
 	response.headers.set('X-Content-Type-Options', 'nosniff');
 	response.headers.set('X-Frame-Options', 'DENY');
-	if (presentationPath) {
+	if (presentationPath || presentationTestPath) {
 		response.headers.set('Cache-Control', 'no-store');
-		response.headers.set('Referrer-Policy', 'no-referrer');
+		response.headers.set('Referrer-Policy', 'strict-origin-when-cross-origin');
+		response.headers.set(
+			'Content-Security-Policy',
+			"frame-src https://www.youtube-nocookie.com https://www.youtube.com https://www.tiktok.com; frame-ancestors 'none'"
+		);
 	}
 	if (event.url.pathname === '/einladung' || event.url.pathname === '/passwort-zuruecksetzen') {
 		response.headers.set('Cache-Control', 'no-store');