From 2562f98cbca97be8e8585b4fd6edce9b4f548ed5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jakub=20Ko=C5=82odziejczak?= <31549762+mrl5@users.noreply.github.com> Date: Sun, 6 Nov 2022 18:00:16 +0100 Subject: [PATCH] fix(backend): improve csp (#861) rationale for setting `'unsafe-inline'` is that it cannot be more void than the lack of `script-src` but it still might add some benefits --- backend/windmill-api/src/static_assets.rs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/backend/windmill-api/src/static_assets.rs b/backend/windmill-api/src/static_assets.rs index bcc0467b8e..30b7072f12 100644 --- a/backend/windmill-api/src/static_assets.rs +++ b/backend/windmill-api/src/static_assets.rs @@ -80,7 +80,7 @@ fn serve_path(path: String, can_set_security_headers: bool) -> Response } fn set_security_headers(mut res: Builder) -> Builder { - let csp = "frame-ancestors 'none'; frame-src 'none'; worker-src 'self'; child-src 'none'; object-src 'none'"; + let csp = "frame-ancestors 'none'; frame-src 'none'; worker-src 'self'; child-src 'none'; object-src 'none'; script-src 'self' 'unsafe-inline'"; res = res.header("Content-Security-Policy", csp); res = res.header("X-Frame-Options", "DENY"); res = res.header("X-Content-Type-Options", "nosniff");