starred/windmill
1
0
Fork 0
mirror of https://github.com/windmill-labs/windmill.git synced 2026-08-25 00:01:55 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(backend): improve csp (#861)

Browse Source 
rationale for setting `'unsafe-inline'` is that it cannot be more void
than the lack of `script-src` but it still might add some benefits
This commit is contained in:
Jakub Kołodziejczak
2022-11-06 18:00:16 +01:00
committed by GitHub
parent c05a080d1a
commit 2562f98cbc
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/windmill-api/src/static_assets.rs
+1 -1
View File
@@ -80,7 +80,7 @@ fn serve_path(path: String, can_set_security_headers: bool) -> Response<BoxBody>
}
fn set_security_headers(mut res: Builder) -> Builder {
let csp = "frame-ancestors 'none'; frame-src 'none'; worker-src 'self'; child-src 'none'; object-src 'none'";
let csp = "frame-ancestors 'none'; frame-src 'none'; worker-src 'self'; child-src 'none'; object-src 'none'; script-src 'self' 'unsafe-inline'";
res = res.header("Content-Security-Policy", csp);
res = res.header("X-Frame-Options", "DENY");
res = res.header("X-Content-Type-Options", "nosniff");