felixfoertsch/tildes
1
0
Fork 0
mirror of https://gitlab.com/tildes/tildes.git synced 2026-04-16 06:18:34 +02:00
Code Issues Packages Projects Releases Wiki Activity

Map the content_security_policy header to the request_uri.

Browse Source
This commit is contained in:
Bauke
2023-07-07 23:23:55 +02:00
committed by Deimos
parent 0bfcea102b
commit 462dbfb580
1 changed files with 10 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
ansible/roles/nginx_site_config/templates/tildes.conf.jinja2
View File

@@ -11,6 +11,15 @@ map $sent_http_content_type $expires_type_map {
~image/ max;
}
map $request_uri $csp_header {
# The default CSP:
# - "img-src data:" is needed for Spectre.css icons
default "default-src 'none'; script-src 'self'; style-src 'self'; img-src 'self' data:; connect-src 'self'; manifest-src 'self'; form-action 'self'; frame-ancestors 'none'; base-uri 'none'";
# The CSP for the Stripe donation page:
# - "https://js.stripe.com" in script-src and frame-src is needed for Stripe
"~^/donate_stripe$" "default-src 'none'; script-src 'self' https://js.stripe.com; style-src 'self'; img-src 'self' data:; connect-src 'self'; manifest-src 'self'; frame-src 'self' https://js.stripe.com; form-action 'self'; frame-ancestors 'none'; base-uri 'none'";
}
server {
# block bots that don't obey robots.txt
if ($http_user_agent ~* (SemrushBot)) {
@@ -39,10 +48,7 @@ server {
{% endif %}
{% if nginx_enable_csp %}
# Content Security Policy:
# - "img-src data:" is needed for Spectre.css icons
# - "https://js.stripe.com" in script-src and frame-src is needed for Stripe
add_header Content-Security-Policy "default-src 'none'; script-src 'self' https://js.stripe.com; style-src 'self'; img-src 'self' data:; connect-src 'self'; manifest-src 'self'; frame-src 'self' https://js.stripe.com; form-action 'self'; frame-ancestors 'none'; base-uri 'none'" always;
add_header Content-Security-Policy $csp_header always;
{% endif %}
add_header X-Content-Type-Options "nosniff" always;