...
<add name="X-Frame-Options" value="SAMEORIGIN" />
<add name="X-Content-Type-Options" value="nosniff" />
<add name="Referrer-Policy" value="strictno-originreferrer-when-cross-origindowngrade" />
<add name="Strict-Transport-Security" value="max-age=31536000; includeSubDomains; preload" />
<add name="Permissions-Policy" value="geolocation=(*)" />
...