Any Umbracian has a idea for this ? 😄

How are your headers configured for this?

simple using the builder:

public static IApplicationBuilder ConfigureSecurityHeaders(this IApplicationBuilder app, IWebHostEnvironment env, IConfiguration config)
    {
        app.UseReferrerPolicy(opts => opts.StrictOrigin());
        app.UseXfo(options => options.SameOrigin());
        app.UseXXssProtection(options => options.EnabledWithBlockMode());
        app.UseXContentTypeOptions();

        return app;
    }

Interesting.

Just to be sure, your also running on cloud ?

Yep, just pushed to cloud to check.

hmm let me check

I'm not using NWebsec, which looks like a dead project now, as security moves quickly and adding headers is trivial. (on a related note, take a look at https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection)

It's just one example

That's weird.

IM doubting if its even deployed atm..

I tested on an umbraco.io URL

The Application URL configuration ?

And is that the URL you're using the backoffice from?

its the same yes

Crazy

yep 😛 haha

Yeah, first in mine too.

Been trying some more stuff, no luck 😦