Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add a Content Security Policy #44

Open
wants to merge 8 commits into
base: master
Choose a base branch
from
Open

Add a Content Security Policy #44

Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
08f311a
add a Content Security Policy to flaggr
Res260 Jan 27, 2020
94f733f
fix fonts and stylesheets for the CSP
Res260 Jan 27, 2020
5a86996
try to remove unsafe-eval from csp
Res260 Jan 27, 2020
f0c78e8
try to remove unsafe-inline from csp
Res260 Jan 27, 2020
01f7aa5
revert last commit
Res260 Jan 27, 2020
05e53ce
fix case where csp would block 'data:' images
Res260 Jan 27, 2020
666550a
fix case where csp would block admin fonts
Res260 Jan 27, 2020
54bbf11
Update nginx.conf
Res260 Jan 27, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions nginx/nginx.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -63,6 +63,12 @@ http {
# ref: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection
add_header X-Xss-Protection "1; mode=block" always;

# with Content Security Policy (CSP) enabled(and a browser that supports it(http://caniuse.com/#feat=contentsecuritypolicy),
# you can tell the browser that it can only download content from the domains you explicitly allow
# http://www.html5rocks.com/en/tutorials/security/content-security-policy/
# https://www.owasp.org/index.php/Content_Security_Policy
add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' ; img-src 'self' data:; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdn.materialdesignicons.com; font-src 'self' https://cdn.materialdesignicons.com https://fonts.gstatic.com/; object-src 'none'";

location /admin {
alias /var/www/html/admin;
index index.html;
Expand Down