From 2efc031cd2b5a1f7304a7c0c28b2445a243cf764 Mon Sep 17 00:00:00 2001
From: David Buchanan <d@vidbuchanan.co.uk>
Date: Wed, 5 Nov 2025 17:06:48 +0000
Subject: [PATCH] bskyweb: configure basic CSP

---
 bskyweb/cmd/bskyweb/server.go | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/bskyweb/cmd/bskyweb/server.go b/bskyweb/cmd/bskyweb/server.go
index c7350d37da..ef86f32dbb 100644
--- a/bskyweb/cmd/bskyweb/server.go
+++ b/bskyweb/cmd/bskyweb/server.go
@@ -135,12 +135,11 @@ func serve(cctx *cli.Context) error {
 
 	// SECURITY: Do not modify without due consideration.
 	e.Use(middleware.SecureWithConfig(middleware.SecureConfig{
-		ContentTypeNosniff: "nosniff",
-		XFrameOptions:      "SAMEORIGIN",
-		HSTSMaxAge:         31536000, // 365 days
-		// TODO:
-		// ContentSecurityPolicy
-		// XSSProtection
+		ContentTypeNosniff:    "nosniff",
+		XFrameOptions:         "SAMEORIGIN",
+		HSTSMaxAge:            31536000, // 365 days
+		ContentSecurityPolicy: fmt.Sprintf("default-src * 'unsafe-inline' blob:; script-src 'self' %s", staticCDNHost),
+		// Note: XSSProtection not configured because it is deprecated, superseded by CSP
 	}))
 	e.Use(middleware.LoggerWithConfig(middleware.LoggerConfig{
 		// Don't log requests for static content.