Remove deprecated headers and stale policy features

bin/_headers.config.ts

@@ -120,50 +120,87 @@ const config: HeadersConfig = {
             'https://www.gstatic.com',
           ],
         },
-        'Feature-Policy': [
-          "accelerometer 'none'",
-          "autoplay 'none'",
-          "camera 'none'",
-          "encrypted-media 'none'",
-          "fullscreen 'none'",
-          "geolocation 'none'",
-          "gyroscope 'none'",
-          "magnetometer 'none'",
-          "microphone 'none'",
-          "midi 'none'",
-          "payment 'none'",
-          "picture-in-picture 'none'",
-          "usb 'none'",
-          "sync-xhr 'none'",
-        ],
+        // While many of these features do not seem to have any security
+        // implication, deny them out of an abundance of caution to limit what
+        // injected or embedded content can reach. See
+        // https://github.com/w3c/webappsec-permissions-policy/blob/main/features.md
+        // for the features that exist.
         'Permissions-Policy': [
           'accelerometer=()',
-          'ambient-light-sensor=()',
+          'aria-notify=()',
           'autoplay=()',
-          'battery=()',
+          'bluetooth=()',
+          'browsing-topics=()',
           'camera=()',
+          'captured-surface-control=()',
+          'ch-device-memory=()',
+          'ch-downlink=()',
+          'ch-dpr=()',
+          'ch-ect=()',
+          'ch-prefers-color-scheme=()',
+          'ch-prefers-reduced-motion=()',
+          'ch-prefers-reduced-transparency=()',
+          'ch-rtt=()',
+          'ch-save-data=()',
+          'ch-ua=()',
+          'ch-ua-arch=()',
+          'ch-ua-bitness=()',
+          'ch-ua-form-factors=()',
+          'ch-ua-full-version=()',
+          'ch-ua-full-version-list=()',
+          'ch-ua-high-entropy-values=()',
+          'ch-ua-mobile=()',
+          'ch-ua-model=()',
+          'ch-ua-platform=()',
+          'ch-ua-platform-version=()',
+          'ch-ua-wow64=()',
+          'ch-viewport-height=()',
+          'ch-viewport-width=()',
+          'ch-width=()',
+          'clipboard-read=()',
+          'clipboard-write=(self)',
+          'compute-pressure=()',
+          'cross-origin-isolated=()',
+          'digital-credentials-get=()',
           'display-capture=()',
-          'document-domain=()',
           'encrypted-media=()',
-          'execution-while-not-rendered=()',
-          'execution-while-out-of-viewport=()',
           'fullscreen=()',
           'gamepad=()',
           'geolocation=()',
           'gyroscope=()',
           'hid=()',
+          'identity-credentials-get=()',
           'idle-detection=()',
+          'interest-cohort=()',
+          'join-ad-interest-group=()',
+          'keyboard-map=()',
+          'language-detector=()',
+          'language-model=()',
+          'local-fonts=()',
+          'local-network=()',
+          'local-network-access=()',
+          'loopback-network=()',
           'magnetometer=()',
           'microphone=()',
           'midi=()',
+          'on-device-speech-recognition=()',
+          'otp-credentials=()',
           'payment=()',
           'picture-in-picture=()',
+          'private-state-token-issuance=()',
+          'private-state-token-redemption=()',
+          'publickey-credentials-create=()',
           'publickey-credentials-get=()',
+          'run-ad-auction=()',
           'screen-wake-lock=()',
           'serial=()',
-          'speaker-selection=()',
+          'summarizer=()',
+          'sync-xhr=()',
+          'translator=()',
+          'unload=()',
           'usb=()',
           'web-share=()',
+          'window-management=()',
           'xr-spatial-tracking=()',
         ],
         'Referrer-Policy': ['strict-origin-when-cross-origin'],
@@ -174,7 +211,6 @@ const config: HeadersConfig = {
         ],
         'X-Content-Type-Options': ['nosniff'],
         'X-Frame-Options': ['DENY'],
-        'X-XSS-Protection': ['1', 'mode=block'],
       },
     },
   ],