use helmet

Author: michaljaz

package-lock.json

@@ -19,6 +19,7 @@
     "dat.gui": "^0.7.7",
     "express": "^4.17.1",
     "flying-squid": "^1.4.0",
+    "helmet": "^4.4.1",
     "html-webpack-plugin": "^4.5.1",
     "http": "0.0.1-security",
     "https": "^1.0.0",

package.json

@@ -10,15 +10,13 @@ module.exports=(mode)->
 	vec3=require "vec3"
 	Convert = require "ansi-to-html"
 	convert = new Convert()
+	helmet = require "helmet"
 
 	sf={}
 	socketInfo={}
 	port=process.env.PORT or 8080
 
-	app.use (req, res, next)->
-		res.setHeader 'Content-Security-Policy', 'worker-src *'
-		next()
-		return
+	app.use helmet()
 
 	if mode is "production"
 		app.use express.static "#{__dirname}/client/dist"