PostERG/xamxam
1
0
Fork 0
mirror of https://codeberg.org/PostERG/xamxam.git synced 2026-08-10 15:21:22 +02:00
Code Issues Packages Projects Releases Wiki Activity

nginx: open CSP frame-src from hardcoded domain whitelist to https: scheme-wide

Browse Source
This commit is contained in:
Pontoporeia
2026-07-10 17:26:02 +02:00
parent 6e1d54511d
commit 9965529fd4
2 changed files with 4 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
nginx/xamxam.conf
+3 -3
View File
@@ -56,7 +56,7 @@ server {
# Security headers
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload;" always;
add_header Content-Security-Policy "default-src 'self'; frame-src 'self' https://videos.erg.be https://depnum.happyngreen.fr; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; object-src 'none'; frame-ancestors 'none';" always;
add_header Content-Security-Policy "default-src 'self'; frame-src 'self' https:; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; object-src 'none'; frame-ancestors 'none';" always;
add_header X-Frame-Options "DENY" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
@@ -145,7 +145,7 @@ server {
# script-src needs 'unsafe-inline' for the OverType editor init block
# and the live-reload poller (dev only). Admin is already auth-gated.
# 'unsafe-eval' is required by htmx (uses Function() internally).
add_header Content-Security-Policy "default-src 'self'; frame-src 'self' https://videos.erg.be https://depnum.happyngreen.fr; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; object-src 'none'; frame-ancestors 'none';" always;
add_header Content-Security-Policy "default-src 'self'; frame-src 'self' https:; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; object-src 'none'; frame-ancestors 'none';" always;
# Disable directory listing
autoindex off;
@@ -190,7 +190,7 @@ server {
# try_files triggers an internal redirect to location = /index.php, which
# loses this CSP override and inherits the server-block frame-ancestors 'none'.
location = /media {
add_header Content-Security-Policy "default-src 'self'; frame-src 'self' https://videos.erg.be https://depnum.happyngreen.fr; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; object-src 'none'; frame-ancestors 'self';" always;
add_header Content-Security-Policy "default-src 'self'; frame-src 'self' https:; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; object-src 'none'; frame-ancestors 'self';" always;
# Direct fastcgi_pass to /index.php (no try_files) so add_header survives.
# We can't use snippets/fastcgi-php.conf because its try_files
# $fastcgi_script_name =404 would fail — $fastcgi_script_name is /media