Skip to content

Remove deprecated headers and stale policy features - #1728

Open
mm-kevcenteno wants to merge 3 commits into
mainfrom
kevin/policy-headers
Open

Remove deprecated headers and stale policy features #1728
mm-kevcenteno wants to merge 3 commits into
mainfrom
kevin/policy-headers

Conversation

@mm-kevcenteno

@mm-kevcenteno mm-kevcenteno commented Aug 12, 2026 •
edited by coderabbitai Bot
Loading

Copy link
Copy Markdown
Contributor

Summary by CodeRabbit

  • Bug Fixes
    • Updated browser security permissions using the modern Permissions-Policy configuration.
    • Removed obsolete security directives and headers to improve compatibility with current browsers.

@coderabbitai

coderabbitai Bot commented Aug 12, 2026 •
edited
Loading

Copy link
Copy Markdown

Review Change Stack

Important

  • 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: d8704ed7-0c42-4f5f-b1f6-98579854871a

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 9f99710e-4d0a-4ea6-8e45-8b2924120280

📥 Commits

Reviewing files that changed from the base of the PR and between 8022033 and bf7934d.

📒 Files selected for processing (1)
  • bin/_headers.config.ts
📝 Walkthrough

Walkthrough

The header configuration replaces Feature-Policy with the existing Permissions-Policy configuration, removes several permissions directives, and deletes the obsolete X-XSS-Protection header.

Changes

Security header policy

Layer / File(s) Summary
Header policy configuration
bin/_headers.config.ts		 The configuration retains Permissions-Policy with explanatory comments, removes selected directives, and deletes Feature-Policy and X-XSS-Protection.

Estimated code review effort: 2 (Simple) | ~10 minutes

Mergeability Score: ⚪ Minimal · up to bf793

This PR makes a localized cleanup to deprecated headers and stale policy features in one configuration file; no actionable merge-blocking risk remains after normal checks and review.

Suggested reviewers: kevcenteno

Poem

A rabbit trims the headers tight,
Keeps permissions rules in sight.
Old policies hop away,
XSS guards rest today.
Clean config greets the light.

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly summarizes the removal of deprecated headers and stale policy features described in the changeset.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches 💡 1
🛠️ Fix failing CI checks 💡
  • Create stacked PR
  • Commit on current branch
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch kevin/policy-headers

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@cloudflare-workers-and-pages

cloudflare-workers-and-pages Bot commented Aug 26, 2026 •
edited
Loading

Copy link
Copy Markdown

Deploying dev-site with  Cloudflare Pages  Cloudflare Pages

Latest commit: 344762b
Status: ✅  Deploy successful!
Preview URL: https://ed92d467.dev-site-4ua.pages.dev
Branch Preview URL: https://kevin-policy-headers.dev-site-4ua.pages.dev

View logs

@mm-kevcenteno
Remove deprecated headers and stale policy features
63e5a89 
Feature-Policy was superseded by Permissions-Policy. X-XSS-Protection is
non-standard, deprecated, and can itself introduce XSS vulnerabilities in
otherwise safe pages; our Content-Security-Policy covers what it was for.

Also drop the Permissions-Policy features that no browser recognizes,
verified against Chrome 149 and 150: ambient-light-sensor, battery,
document-domain, execution-while-not-rendered,
execution-while-out-of-viewport, and speaker-selection. Chrome reported
each of these as an unrecognized feature, so they never had any effect.
@mm-kevcenteno
Keep denying sync-xhr after the Feature-Policy removal
db9968c 
sync-xhr was denied only via Feature-Policy and had no Permissions-Policy
counterpart, so removing that header dropped the denial entirely. Chrome
still enforces Feature-Policy, and sync-xhr defaults to an allowlist of *,
so this was blocking synchronous XHR in the top document and in every
cross-origin frame.
@mm-kevcenteno
Deny 53 more Permissions-Policy features
344762b 
This brings the policy to the same 76 features mm_website denies. The
list was 22 features short of mm_website, and a further 31 recognized
features were denied on none of the three sites.

clipboard-write allows self because the copy button in
assets/js/copy-markdown.ts calls navigator.clipboard.writeText. Every
other addition is a flat deny.

static/_headers is generated, so run npm run build:headers to pick this
up.
Copilot AI lite review requested due to automatic review settings August 26, 2026 19:57
Copilot AI reviewed Aug 26, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot wasn't able to review any files in this pull request.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@mm-kevcenteno