e2m/dispatch
4
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Add worker-src csp directive

Browse Source
This commit is contained in:
Ken-Håvard Lieng 2018-11-14 08:34:35 +01:00
parent a783a87d04
commit d867ca8477
1 changed files with 12 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
server/serve_files.go
View File

@ -289,7 +289,18 @@ func (d *Dispatch) serveIndex(w http.ResponseWriter, r *http.Request) {
inlineSha = inlineScriptSWSha256
}
w.Header().Set("Content-Security-Policy", "default-src 'none'; script-src 'self' 'sha256-"+inlineSha+"'; style-src 'self' 'unsafe-inline'; font-src 'self'; img-src 'self'; manifest-src 'self'; connect-src 'self' "+wsSrc)
csp := []string{
"default-src 'none'",
"script-src 'self' 'sha256-" + inlineSha + "'",
"style-src 'self' 'unsafe-inline'",
"font-src 'self'",
"img-src 'self'",
"manifest-src 'self'",
"connect-src 'self' " + wsSrc,
"worker-src 'self'",
}
w.Header().Set("Content-Security-Policy", strings.Join(csp, "; "))
}
w.Header().Set("Content-Type", "text/html")