diff options
| author | Marcello Stanisci <stanisci.m@gmail.com> | 2019-02-22 19:08:39 +0100 |
|---|---|---|
| committer | Marcello Stanisci <stanisci.m@gmail.com> | 2019-02-22 19:08:39 +0100 |
| commit | 544365edefadb45b91558f3c50820f16541209d2 (patch) | |
| tree | 4d3b96e107b7731c4ddcecb0e353e575522a24a3 | |
| parent | 6aed63598ba221ad7b2e0c80361263e590caf249 (diff) | |
| download | deployment-544365edefadb45b91558f3c50820f16541209d2.tar.gz deployment-544365edefadb45b91558f3c50820f16541209d2.tar.bz2 deployment-544365edefadb45b91558f3c50820f16541209d2.zip | |
CSP.
Reenabling taler.net as 'script-src' and 'style-src' as
those are NOT inherited from 'default-src'.
| -rw-r--r-- | etc/nginx/conf.d/talerssl | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/etc/nginx/conf.d/talerssl b/etc/nginx/conf.d/talerssl index 742c9ab..71ad727 100644 --- a/etc/nginx/conf.d/talerssl +++ b/etc/nginx/conf.d/talerssl @@ -10,5 +10,5 @@ add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; prelo add_header X-XSS-Protection "1; mode=block"; add_header X-Frame-Options "SAMEORIGIN"; add_header X-Content-Type-Options "nosniff"; -add_header Content-Security-Policy "default-src 'self' https://www.taler.net/dist/; img-src 'self' data:; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; connect-src 'self' wss://buildbot.taler.net"; +add_header Content-Security-Policy "default-src 'self' https://www.taler.net/dist/; img-src 'self' data:; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://www.taler.net/dist/js/; style-src 'self' 'unsafe-inline' https://www.taler.net/dist/css/; connect-src 'self' wss://buildbot.taler.net"; add_header Referrer-Policy "same-origin"; |