From f74945ae146e58ae95433ea96d81706e0773f7cb Mon Sep 17 00:00:00 2001 From: Harsh Shandilya Date: Tue, 2 Jun 2020 02:24:18 +0530 Subject: [PATCH] Caddyfile: update CSP Signed-off-by: Harsh Shandilya --- Caddyfile | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/Caddyfile b/Caddyfile index 64799f7..2f5a702 100644 --- a/Caddyfile +++ b/Caddyfile @@ -15,10 +15,10 @@ default-src 'self'; frame-ancestors 'none'; font-src 'self' data: commento.msfjarvis.dev stackpath.bootstrapcdn.com; - img-src 'self' data: gfycat.com imgur.com *.imgur.com commento.msfjarvis.dev; + img-src 'self' data: gfycat.com imgur.com *.imgur.com commento.msfjarvis.dev *.amazonaws.com; object-src 'none'; - script-src 'self' commento.msfjarvis.dev 'sha256-o7J3VkM1HdcyiYXa81laTjuC7e15LtXtTRm8x3cx2cw' 'nonce-Y2xvYWtlbWFpbAo='; - style-src 'self' commento.msfjarvis.dev stackpath.bootstrapcdn.com 'sha256-PjBkwE8xcYZAp+HsnzzOVNqa/Ra+/v1Fnx6f0PW6ic4=' 'sha256-47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=' 'nonce-Y2xvYWtlbWFpbAo='; + script-src 'self' commento.msfjarvis.dev 'sha256-o7J3VkM1HdcyiYXa81laTjuC7e15LtXtTRm8x3cx2cw' 'nonce-Y2xvYWtlbWFpbAo=' 'unsafe-inline'; + style-src 'self' commento.msfjarvis.dev stackpath.bootstrapcdn.com 'sha256-PjBkwE8xcYZAp+HsnzzOVNqa/Ra+/v1Fnx6f0PW6ic4=' 'sha256-47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=' 'nonce-Y2xvYWtlbWFpbAo=' 'unsafe-inline'; " # Security related changes stolen from https://github.com/searx/searx-docker/blob/master/Caddyfile Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"