acetheking987/bsky-social-app
1
0
Fork 0
Code Issues Actions Packages Projects Releases 1 Wiki Activity

bskyweb: configure basic CSP

Browse Source
This commit is contained in:
David Buchanan
2025-11-05 17:06:48 +00:00
parent 531ff6c433
commit 2efc031cd2
1 changed files with 5 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
bskyweb/cmd/bskyweb/server.go
+5 -6
View File
@@ -135,12 +135,11 @@ func serve(cctx *cli.Context) error {
// SECURITY: Do not modify without due consideration. // SECURITY: Do not modify without due consideration.
e.Use(middleware.SecureWithConfig(middleware.SecureConfig{ e.Use(middleware.SecureWithConfig(middleware.SecureConfig{
ContentTypeNosniff: "nosniff", ContentTypeNosniff: "nosniff",
XFrameOptions: "SAMEORIGIN", XFrameOptions: "SAMEORIGIN",
HSTSMaxAge: 31536000, // 365 days HSTSMaxAge: 31536000, // 365 days
// TODO: ContentSecurityPolicy: fmt.Sprintf("default-src * 'unsafe-inline' blob:; script-src 'self' %s", staticCDNHost),
// ContentSecurityPolicy // Note: XSSProtection not configured because it is deprecated, superseded by CSP
// XSSProtection
})) }))
e.Use(middleware.LoggerWithConfig(middleware.LoggerConfig{ e.Use(middleware.LoggerWithConfig(middleware.LoggerConfig{
// Don't log requests for static content. // Don't log requests for static content.