From 71f335c2fcac974af4672cb521751ba6cdee06a6 Mon Sep 17 00:00:00 2001 From: Claire Date: Tue, 13 Apr 2021 23:43:41 +0200 Subject: [PATCH] Add HTTP header to explicitly opt out of FLoC by default (#16036) Fixes #16034 --- config/environments/production.rb | 1 + 1 file changed, 1 insertion(+) diff --git a/config/environments/production.rb b/config/environments/production.rb index 6df0a3365..22be14749 100644 --- a/config/environments/production.rb +++ b/config/environments/production.rb @@ -116,6 +116,7 @@ Rails.application.configure do 'X-Frame-Options' => 'DENY', 'X-Content-Type-Options' => 'nosniff', 'X-XSS-Protection' => '1; mode=block', + 'Permissions-Policy' => 'interest-cohort=()', } config.x.otp_secret = ENV.fetch('OTP_SECRET')