requesting slightly more verbose docs for gatsby-plugin-netlify's mergeSecurityHeaders setting

[fool]

Summary

It was not obvious from reading https://www.gatsbyjs.org/packages/gatsby-plugin-netlify/ (particularly the configuration section that the mergeSecurityHeaders set the following header rules widely:

    `X-Frame-Options: DENY`,
    `X-XSS-Protection: 1; mode=block`,
    `X-Content-Type-Options: nosniff`,
    `Referrer-Policy: same-origin`

using MergeSecurityHeaders: false does indeed disable them. Could we get an explicit mention of what those headers are in the docs, which currently gloss over it? I will be happy to create a PR if that is preferred, though I am not sure of the best place to say it. By default I'd probably create a comment block like this, right in the middle of the configuration section, but I am not the best docs writer! Something like this:

// mergeSecurityHeaders: true will set the following:
//     `X-Frame-Options: DENY`,
//    `X-XSS-Protection: 1; mode=block`,
//    `X-Content-Type-Options: nosniff`,
//   `Referrer-Policy: same-origin`

Motivation

This is opaque and can lead to CORS errors with common workflows such as embedding youtube videos in your gatsby pages.

Steps to resolve this issue

I don't propose a behavior change, just some clarity on what that feature does without reading the source code or trying to reverse engineer a deployed netlify site by looking at HTTP response headers in the browser and thinking "I didn't set those...how are they there?"

Please let me know if a PR would be appropriate and I will happily open one following either the above plan or your guidance!

[pieh]

We have couple of plugins that document options in different ways:

• https://github.com/gatsbyjs/gatsby/blob/master/packages/gatsby-source-contentful/README.md#configuration-options
• https://github.com/gatsbyjs/gatsby/blob/master/packages/gatsby-source-wordpress/README.md#how-to-use
• https://github.com/gatsbyjs/gatsby/blob/master/packages/gatsby-remark-images/README.md#options

It would be nice to come around at consistent way of documenting options (and defaults). I think that adding comments to gatsby-config.js example (like in gatsby-source-wordpress README) is least readable way and would like either nested headers (like in gatsby-source-contentful README or table (like in gatsby-remark-images README).

The documentation change to add more clarity to plugin options is always welcome, let's just figure out nicest way to do it and hopefully that would be "go to" way to do this.

[LekoArts]

cc @gatsbyjs/learning

[laurieontech]

Thanks @LekoArts it's on our radar. Would also be open to a community PR!

[github-actions[bot]]

Hiya!

This issue has gone quiet. Spooky quiet. 👻

We get a lot of issues, so we currently close issues after 30 days of inactivity. It’s been at least 20 days since the last update here.
If we missed this issue or if you want to keep it open, please reply here. You can also add the label "not stale" to keep this issue open!
As a friendly reminder: the best way to see this issue, or any other, fixed is to open a Pull Request. Check out gatsby.dev/contribute for more information about opening PRs, triaging issues, and contributing!

Thanks for being a part of the Gatsby community! 💪💜

[github-actions[bot]]

Hey again!

It’s been 30 days since anything happened on this issue, so our friendly neighborhood robot (that’s me!) is going to close it.
Please keep in mind that I’m only a robot, so if I’ve closed this issue in error, I’m HUMAN_EMOTION_SORRY. Please feel free to reopen this issue or create a new one if you need anything else.
As a friendly reminder: the best way to see this issue, or any other, fixed is to open a Pull Request. Check out gatsby.dev/contribute for more information about opening PRs, triaging issues, and contributing!

Thanks again for being part of the Gatsby community! 💪💜

[github-actions[bot]]

Hiya!

This issue has gone quiet. Spooky quiet. 👻

We get a lot of issues, so we currently close issues after 30 days of inactivity. It’s been at least 20 days since the last update here.
If we missed this issue or if you want to keep it open, please reply here. You can also add the label "not stale" to keep this issue open!
As a friendly reminder: the best way to see this issue, or any other, fixed is to open a Pull Request. Check out gatsby.dev/contribute for more information about opening PRs, triaging issues, and contributing!

Thanks for being a part of the Gatsby community! 💪💜

[github-actions[bot]]

Hey again!

It’s been 30 days since anything happened on this issue, so our friendly neighborhood robot (that’s me!) is going to close it.
Please keep in mind that I’m only a robot, so if I’ve closed this issue in error, I’m HUMAN_EMOTION_SORRY. Please feel free to reopen this issue or create a new one if you need anything else.
As a friendly reminder: the best way to see this issue, or any other, fixed is to open a Pull Request. Check out gatsby.dev/contribute for more information about opening PRs, triaging issues, and contributing!

Thanks again for being part of the Gatsby community! 💪💜

[github-actions[bot]]

Hey again!

It’s been 30 days since anything happened on this issue, so our friendly neighborhood robot (that’s me!) is going to close it.
Please keep in mind that I’m only a robot, so if I’ve closed this issue in error, I’m HUMAN_EMOTION_SORRY. Please feel free to reopen this issue or create a new one if you need anything else.
As a friendly reminder: the best way to see this issue, or any other, fixed is to open a Pull Request. Check out gatsby.dev/contribute for more information about opening PRs, triaging issues, and contributing!

Thanks again for being part of the Gatsby community! 💪💜