Content Security Policy

[klangborste]

Hi guys,

im searching for a better CSP then this one i use at the moment for apache:

Header set Content-Security-Policy "default-src 'none'; script-src http://seafile.com/ https://www.seafile.com/ 'self' 'unsafe-inline' 'unsafe-eval'; img-src blob: https://[domain].[tld] 'self'; img-src 'self'; font-src 'self'; connect-src 'self'; style-src 'self' 'unsafe-inline';"

I think it could be more fine grained then this.

[klangborste]

Check security server

Hotfix for mp4 file playback on SeaHub Header always set Content-Security-Policy "default-src 'none'; script-src http://seafile.com/ https://www.seafile.com/ https://*.<yourdomain>.<tld>/ blob: 'self' 'unsafe-inline' 'unsafe-eval'; img-src 'self'; font-src data: 'self'; connect-src 'self'; style-src 'self' 'unsafe-inline'; frame-src https://*.<yourdomain>.<tld>; object-src 'none'; frame-ancestors https://*.<yourdomain>.<tld>/; base-uri https://*.<yourdomain>.<tld>/ 'self'; media-src 'self';"