feat: add default Content-Security-Policy header to middleware

src/middleware/mod.rs

@@ -126,6 +126,15 @@ where
                 );
             }
 
+            if !headers.contains_key(actix_web::http::header::CONTENT_SECURITY_POLICY) {
+                let _ = headers.insert(
+                    actix_web::http::header::CONTENT_SECURITY_POLICY,
+                    actix_web::http::header::HeaderValue::from_static(
+                        "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self'; frame-ancestors 'none'"
+                    ),
+                );
+            }
+
             Ok(res)
         })
     }