fix(api): reserve additional browser policy headers

Author: waleedlatif1

apps/sim/lib/workflows/response-security.test.ts

@@ -45,6 +45,17 @@ describe('workflow HTTP response safety', () => {
           'Content-Security-Policy-Report-Only': 'report-uri /untrusted',
           'X-Frame-Options': 'ALLOWALL',
           'X-XSS-Protection': '0',
+          'X-Download-Options': 'untrusted',
+          'X-DNS-Prefetch-Control': 'on',
+          'X-Permitted-Cross-Domain-Policies': 'all',
+          'X-UA-Compatible': 'IE=7',
+          'X-WebKit-CSP': "default-src * 'unsafe-inline'",
+          'X-Content-Security-Policy': "default-src * 'unsafe-inline'",
+          'Accept-CH': 'Sec-CH-UA-Model',
+          'Accept-CH-Lifetime': '86400',
+          'Critical-CH': 'Sec-CH-UA-Model',
+          'Public-Key-Pins': 'max-age=0',
+          'Public-Key-Pins-Report-Only': 'max-age=0; report-uri="/untrusted"',
           'Access-Control-Allow-Origin': '*',
           'Access-Control-Allow-Credentials': 'true',
           'Cross-Origin-Resource-Policy': 'cross-origin',

apps/sim/lib/workflows/utils.ts

@@ -295,6 +295,8 @@ export const workflowHasResponseBlock = (
 
 /** Headers that control the app origin or HTTP transport belong to the server. */
 const RESERVED_RESPONSE_HEADERS = new Set([
+  'accept-ch',
+  'accept-ch-lifetime',
   'alt-svc',
   'clear-site-data',
   'connection',
@@ -303,6 +305,7 @@ const RESERVED_RESPONSE_HEADERS = new Set([
   'content-length',
   'content-location',
   'content-range',
+  'critical-ch',
   'document-policy',
   'keep-alive',
   'link',
@@ -311,6 +314,8 @@ const RESERVED_RESPONSE_HEADERS = new Set([
   'origin-agent-cluster',
   'permissions-policy',
   'proxy-authenticate',
+  'public-key-pins',
+  'public-key-pins-report-only',
   'referrer-policy',
   'refresh',
   'report-to',
@@ -322,8 +327,14 @@ const RESERVED_RESPONSE_HEADERS = new Set([
   'transfer-encoding',
   'upgrade',
   'www-authenticate',
+  'x-content-security-policy',
+  'x-dns-prefetch-control',
+  'x-download-options',
   'x-frame-options',
+  'x-permitted-cross-domain-policies',
   'x-sendfile',
+  'x-ua-compatible',
+  'x-webkit-csp',
   'x-xss-protection',
 ])