ulikoehler/ZeroBin — pull request #1 by Talenka (2013-12-11 10:25:43+00:00)
Title: Prevent data leaks with CSP and HSTS Headers

Same as https://github.com/sebsauvage/ZeroBin/pull/70 , improved.
These headers add two security layers against MITM and XSRF attacks, respectively. Since security is a major feature of this project, they should not be ignored.

* Adding the `Strict-Transport-Security` header, you locks the traffic on https protocol for a day (86400 seconds). If the server is not https-capable, this security layer is simply ignored by browser. See: https://developer.mozilla.org/en-US/docs/Security/HTTP_Strict_Transport_Security

* Adding the `Content-Security-Policy` header, you forbid the browser to load scripts from another domain. This help to address tricky code injections (e.g. unicode tag attributes bypass or `javascript:` URI in users comments). See: https://developer.mozilla.org/en-US/docs/Security/CSP/CSP_policy_directives#script-src

For paranoid people, you should even use `header("Content-Security-Policy: default-src 'self'");` to prevent anything to be loaded except for the very server which run ZeroBin.

The content-security-policy broke inline javascript, so I had to modify `tpl/page.html` and `js/zerobin.js` to add proper event handlers.

[Works perfectly on Firefox 26/27; Chrome 31; Safari 7]