enable APIs for XLSX export in firefox

docs/example.nginx.conf

@@ -57,6 +57,11 @@ server {
     add_header Access-Control-Allow-Origin "*";
     # add_header X-Frame-Options "SAMEORIGIN";
 
+    # Enable SharedArrayBuffer in Firefox (for .xlsx export)
+    add_header Cross-Origin-Resource-Policy cross-origin;
+    add_header Cross-Origin-Opener-Policy same-origin;
+    add_header Cross-Origin-Embedder-Policy require-corp;
+
     # Insert the path to your CryptPad repository root here
     root /home/cryptpad/cryptpad;
     index index.html;

lib/defaults.js

@@ -47,7 +47,10 @@ Default.httpHeaders = function () {
     return {
         "X-XSS-Protection": "1; mode=block",
         "X-Content-Type-Options": "nosniff",
-        "Access-Control-Allow-Origin": "*"
+        "Access-Control-Allow-Origin": "*",
+        "Cross-Origin-Resource-Policy": 'cross-origin',
+        "Cross-Origin-Opener-Policy": 'same-origin',
+        "Cross-Origin-Embedder-Policy": 'require-corp',
     };
 };