Add csp headers

public/typo3conf/ext/ep_events/Configuration/TypoScript/setup.typoscript

@@ -84,6 +84,23 @@ config {
     compressJs = 1
     compressCss = 1
     typolinkEnableLinksAcrossDomains = 1
+    additionalHeaders {
+        10 {
+            header = Content-Security-Policy: default-src 'self' 'unsafe-inline' 'unsafe-inline'
+        }
+        20 {
+            header = Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
+        }
+        30 {
+            header = X-Frame-Options: sameorigin
+        }
+        40 {
+            header = Referrer-Policy: same-origin
+        }
+        50 {
+            header = Permissions-Policy: microphone=(), camera=()
+        }
+    }
 }
 
 [siteLanguage("languageId") == "1"]

public/typo3conf/ext/ep_theme/Configuration/TypoScript/setup.typoscript

@@ -102,4 +102,21 @@ config {
     sendCacheHeaders = 1
     content_from_pid_allowOutsideDomain = 1
     inlineStyle2TempFile = 0
+    additionalHeaders {
+        10 {
+            header = Content-Security-Policy: default-src 'self' 'unsafe-inline' 'unsafe-inline'
+        }
+        20 {
+            header = Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
+        }
+        30 {
+            header = X-Frame-Options: sameorigin
+        }
+        40 {
+            header = Referrer-Policy: same-origin
+        }
+        50 {
+            header = Permissions-Policy: microphone=(), camera=()
+        }
+    }
 }