I am facing the following issues (config in a seperate comment):
- In CORS, the access-control-allow-origin header includes my same-origin but also adds a * wildcard. My Nuxt configuration is provided in a separate comment below. - For XSS protection, it should be enabled by default in Nuxt3. On my development environment, it correctly throws an error when I add
?test=<script>alert(1)</script>
?test=<script>alert(1)</script>
, but this does not happen in my production environment.