added Cross-Origin-Opener-Policy:same-origin to the default security headers

CHANGELOG.md

@@ -7,6 +7,9 @@
 
 - Added `filesystem.NewWriter(key, opts)` low-level helper to allow direct file create from an `io.Reader` value.
 
+- Added `Cross-Origin-Opener-Policy:same-origin` to the default security response headers.
+    _This is just an extra precaution to prevent tab-nabbing in case custom UI plugins use `target="_blank"` without `rel="noopener"`._
+
 
 ## v0.39.11 (WIP)
 

apis/middlewares.go

@@ -293,6 +293,7 @@ func securityHeaders() *hook.Handler[*core.RequestEvent] {
 			e.Response.Header().Set("X-XSS-Protection", "1; mode=block")
 			e.Response.Header().Set("X-Content-Type-Options", "nosniff")
 			e.Response.Header().Set("X-Frame-Options", "SAMEORIGIN")
+			e.Response.Header().Set("Cross-Origin-Opener-Policy", "same-origin")
 
 			// @todo consider a default HSTS?
 			// (see also https://webkit.org/blog/8146/protecting-against-hsts-abuse/)