squeegily/pleroma
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

installation/pleroma.nginx: Add Content-Security-Policy

Browse Source 
Closes: https://git.pleroma.social/pleroma/pleroma/issues/266
This commit is contained in:
Haelwenn (lanodan) Monnier 2018-08-28 20:54:50 +02:00
parent 49b165ddc6
commit 0fd2eaf7af
No known key found for this signature in database
GPG Key ID: D5B7A8E43C997DEE
1 changed files with 1 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
installation/pleroma.nginx
View File

@ -77,6 +77,7 @@ server {
add_header X-Content-Type-Options nosniff; add_header X-Content-Type-Options nosniff;
add_header Referrer-Policy same-origin; add_header Referrer-Policy same-origin;
add_header X-Download-Options noopen; add_header X-Download-Options noopen;
add_header Content-Security-Policy "default-src 'none'; base-uri 'self'; form-action 'self'; img-src 'self' data: https:; media-src 'self' https:; style-src 'self' 'unsafe-inline'; font-src 'self'; script-src 'self'; connect-src 'self' wss://example.tld; upgrade-insecure-requests;";
# Uncomment this only after you get HTTPS working. # Uncomment this only after you get HTTPS working.
# add_header Strict-Transport-Security "max-age=31536000; includeSubDomains"; # add_header Strict-Transport-Security "max-age=31536000; includeSubDomains";