From ddb9b57c5246cbe36d7713c169fbde665744819d Mon Sep 17 00:00:00 2001 From: Harsh Shandilya Date: Wed, 24 Jun 2020 20:41:04 +0530 Subject: [PATCH] Caddyfile: update CSP Signed-off-by: Harsh Shandilya --- Caddyfile | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/Caddyfile b/Caddyfile index 3eeacd4..f8e75a5 100644 --- a/Caddyfile +++ b/Caddyfile @@ -13,7 +13,7 @@ Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" X-XSS-Protection "1; mode=block" X-Frame-Options "SAMEORIGIN" - Feature-Policy "accelerometer 'none';ambient-light-sensor 'none'; autoplay 'none';camera 'none';encrypted-media 'none'; geolocation 'none';gyroscope 'none';magnetometer 'none';microphone 'none';midi 'none';payment 'none';picture-in-picture 'none'; speaker 'none';sync-xhr 'none';usb 'none';vr 'none'" + Feature-Policy "accelerometer 'none'; autoplay 'none';camera 'none';encrypted-media 'none'; geolocation 'none';gyroscope 'none';magnetometer 'none';microphone 'none';midi 'none';payment 'none';picture-in-picture 'none';sync-xhr 'none';usb 'none'" Referrer-Policy "no-referrer" } } @@ -47,6 +47,7 @@ https://msfjarvis.dev { connect-src 'self' commento.msfjarvis.dev; default-src 'self'; frame-ancestors 'none'; + frame-src 'https://github.com'; font-src 'self' data: commento.msfjarvis.dev stackpath.bootstrapcdn.com; img-src 'self' data: gfycat.com imgur.com *.imgur.com commento.msfjarvis.dev *.amazonaws.com; object-src 'none';