Files
warmbly/web/nginx-mail-preview-headers.conf
T
Matthew MeszarosandDevin AI 589bc823ed feat: generate static dashboard CSP hashes and isolate email preview styling across Vite nginx and Pages
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-10-06 05:46:52 +00:00

7 lines
568 B
Plaintext

# Email markup is styled only inside a script-disabled, same-origin sandbox.
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header Referrer-Policy "no-referrer" always;
add_header Content-Security-Policy "default-src 'none'; script-src 'none'; object-src 'none'; base-uri 'none'; form-action 'none'; frame-ancestors 'self'; style-src 'unsafe-inline'; img-src data: https: http:; font-src data: https:; media-src https:" always;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;