Did you configure security headers on the server?

Yes, I have configured them. Security headers on the server help protect the web application from various attacks and improve security.

The main headers I usually configure are:

• Content-Security-Policy (CSP) — restricts content sources, preventing XSS attacks.
• X-Content-Type-Options: nosniff — prevents the browser from guessing MIME types, which prevents certain attacks.
• X-Frame-Options: DENY or SAMEORIGIN — prevents the page from being embedded in an iframe, protecting against clickjacking.
• Strict-Transport-Security (HSTS) — forces the browser to use HTTPS.
• Referrer-Policy — controls what referrer information is sent.
• Permissions-Policy — restricts access to browser APIs.

Example of configuration in Express.js:

const helmet = require('helmet');
app.use(helmet());

Helmet automatically adds most of these headers.

In projects using Nginx or Apache, headers are configured through configuration files, for example:

add_header X-Frame-Options "SAMEORIGIN";
add_header X-Content-Type-Options "nosniff";
add_header Content-Security-Policy "default-src 'self'";

Thus, configuring security headers is an important step to protect the frontend and the entire application.