Apache security

Any chance of setting security headers in apache?

HTTP Security Header	Header Role	Status
X-Frame-Options	Protects against Clickjacking attacks	Not set
X-XSS-Protection	Mitigates Cross-Site Scripting (XSS) attacks	Not set
Strict-Transport-Security	Protects against man-in-the-middle attacks	Not set
X-Content-Type-Options	Prevents possible phishing or XSS attacks	Not set

image

As far as I know, Home Assistant doesn’t use Apache at all.

Okie dokie, I thought it was a python driven apache webserver.

Either way, still could do with having the Security Headers sorted for that little extra security.

Home Assistant uses AIOHTTP

Feel free to submit a pull request.