Skip to content

Remove deprecated headers and stale policy features - #1728

Open
mm-kevcenteno wants to merge 2 commits into
mainfrom
kevin/policy-headers
Open

Remove deprecated headers and stale policy features #1728
mm-kevcenteno wants to merge 2 commits into
mainfrom
kevin/policy-headers

Conversation

@mm-kevcenteno

@mm-kevcenteno mm-kevcenteno commented Aug 12, 2026 •
edited by coderabbitai Bot
Loading

Copy link
Copy Markdown
Contributor

Summary by CodeRabbit

  • Bug Fixes
    • Updated browser security permissions using the modern Permissions-Policy configuration.
    • Removed obsolete security directives and headers to improve compatibility with current browsers.

@kevcenteno
Remove deprecated headers and stale policy features
e8c7334 
Feature-Policy was superseded by Permissions-Policy. X-XSS-Protection is
non-standard, deprecated, and can itself introduce XSS vulnerabilities in
otherwise safe pages; our Content-Security-Policy covers what it was for.

Also drop the Permissions-Policy features that no browser recognizes,
verified against Chrome 149 and 150: ambient-light-sensor, battery,
document-domain, execution-while-not-rendered,
execution-while-out-of-viewport, and speaker-selection. Chrome reported
each of these as an unrecognized feature, so they never had any effect.
@kevcenteno
Keep denying sync-xhr after the Feature-Policy removal
bf7934d 
sync-xhr was denied only via Feature-Policy and had no Permissions-Policy
counterpart, so removing that header dropped the denial entirely. Chrome
still enforces Feature-Policy, and sync-xhr defaults to an allowlist of *,
so this was blocking synchronous XHR in the top document and in every
cross-origin frame.
@coderabbitai

coderabbitai Bot commented Aug 12, 2026 •
edited
Loading

Copy link
Copy Markdown

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 9f99710e-4d0a-4ea6-8e45-8b2924120280

📥 Commits

Reviewing files that changed from the base of the PR and between 8022033 and bf7934d.

📒 Files selected for processing (1)
  • bin/_headers.config.ts
📝 Walkthrough

Walkthrough

The header configuration replaces Feature-Policy with the existing Permissions-Policy configuration, removes several permissions directives, and deletes the obsolete X-XSS-Protection header.

Changes

Security header policy

Layer / File(s) Summary
Header policy configuration
bin/_headers.config.ts		 The configuration retains Permissions-Policy with explanatory comments, removes selected directives, and deletes Feature-Policy and X-XSS-Protection.

Estimated code review effort: 2 (Simple) | ~10 minutes

Mergeability Score: ⚪ Minimal · up to bf793

This PR makes a localized cleanup to deprecated headers and stale policy features in one configuration file; no actionable merge-blocking risk remains after normal checks and review.

Suggested reviewers: kevcenteno

Poem

A rabbit trims the headers tight,
Keeps permissions rules in sight.
Old policies hop away,
XSS guards rest today.
Clean config greets the light.

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly summarizes the removal of deprecated headers and stale policy features described in the changeset.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches 💡 1
🛠️ Fix failing CI checks 💡
  • Create stacked PR
  • Commit on current branch
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch kevin/policy-headers

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@mm-kevcenteno @kevcenteno