authelia: expand CSP template

saltyorg · Aug 28, 2023 · f802839 · f802839
1 parent ce00dec
commit f802839
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/roles/authelia/defaults/main.yml b/roles/authelia/defaults/main.yml
@@ -86,7 +86,7 @@ authelia_server_buffers_write: "10485760"
 authelia_server_enable_pprof: "false"
 authelia_server_enable_expvars: "false"
 authelia_server_disable_healthcheck: "false"
-authelia_server_headers_csp_template: "frame-ancestors 'self' *.{{ user.domain }} {{ user.domain }}; default-src 'self'; object-src 'none'; style-src 'self' 'nonce-${NONCE}'"
+authelia_server_headers_csp_template: "default-src 'self' *.{{ user.domain }} {{ user.domain }}; script-src 'self' *.{{ user.domain }} {{ user.domain }}; script-src-elem 'self' *.{{ user.domain }} {{ user.domain }}; script-src-attr 'self' *.{{ user.domain }} {{ user.domain }}; style-src 'self' *.{{ user.domain }} {{ user.domain }} 'nonce-${NONCE}'; style-src-elem 'self' *.{{ user.domain }} {{ user.domain }} 'nonce-${NONCE}'; style-src-attr 'self' *.{{ user.domain }} {{ user.domain }} 'nonce-${NONCE}'; img-src 'self' *.{{ user.domain }} {{ user.domain }}; font-src 'self' *.{{ user.domain }} {{ user.domain }}; connect-src 'self' *.{{ user.domain }} {{ user.domain }}; media-src 'self' *.{{ user.domain }} {{ user.domain }}; object-src 'self' *.{{ user.domain }} {{ user.domain }}; child-src 'self' *.{{ user.domain }} {{ user.domain }}; frame-src 'self' *.{{ user.domain }} {{ user.domain }}; worker-src 'self' *.{{ user.domain }} {{ user.domain }}; frame-ancestors 'self' *.{{ user.domain }} {{ user.domain }}; form-action 'self' *.{{ user.domain }} {{ user.domain }}; base-uri 'self'"
 
 # Settings for Logging
 # Reference: https://www.authelia.com/configuration/miscellaneous/logging/