acetheking987/bsky-social-app
1
0
Fork 0
Code Issues Actions Packages Projects Releases 1 Wiki Activity

add www.youtube.com to script-src CSP

Browse Source
This commit is contained in:
David Buchanan
2025-11-07 16:53:19 +00:00
parent 2efc031cd2
commit 45420db9fa
1 changed files with 7 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
bskyweb/cmd/bskyweb/server.go
+7 -4
View File
@@ -135,10 +135,13 @@ func serve(cctx *cli.Context) error {
// SECURITY: Do not modify without due consideration. // SECURITY: Do not modify without due consideration.
e.Use(middleware.SecureWithConfig(middleware.SecureConfig{ e.Use(middleware.SecureWithConfig(middleware.SecureConfig{
ContentTypeNosniff: "nosniff", ContentTypeNosniff: "nosniff",
XFrameOptions: "SAMEORIGIN", XFrameOptions: "SAMEORIGIN",
HSTSMaxAge: 31536000, // 365 days HSTSMaxAge: 31536000, // 365 days
ContentSecurityPolicy: fmt.Sprintf("default-src * 'unsafe-inline' blob:; script-src 'self' %s", staticCDNHost), // Note: If you're reading this because CSP broke something important, you can temporarily disable it by commenting the below line.
ContentSecurityPolicy: fmt.Sprintf("default-src * 'unsafe-inline' blob:; script-src 'self' %s www.youtube.com;", staticCDNHost),
// Our Youtube embeds are double-iframed. The outer iframe is on bsky.app and needs to run scripts from https://www.youtube.com/iframe_api
// Note: XSSProtection not configured because it is deprecated, superseded by CSP // Note: XSSProtection not configured because it is deprecated, superseded by CSP
})) }))
e.Use(middleware.LoggerWithConfig(middleware.LoggerConfig{ e.Use(middleware.LoggerWithConfig(middleware.LoggerConfig{