From 43f2835e414cdb5f7efa64c18ababb1817738b7f Mon Sep 17 00:00:00 2001 From: iacore Date: Fri, 16 Feb 2024 14:17:12 +0000 Subject: [PATCH] Add to CSP: form-action 'self'; frame-ancestors 'none' --- main.go | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/main.go b/main.go index bcafe05..3ae9604 100644 --- a/main.go +++ b/main.go @@ -131,8 +131,8 @@ func main() { c.Set("X-Content-Type-Options", "nosniff") c.Set("Referrer-Policy", "no-referrer") c.Set("Strict-Transport-Security", "max-age=31536000; includeSubDomains; preload") - c.Set("Content-Security-Policy", fmt.Sprintf("default-src 'none'; script-src 'self'; style-src 'self'; img-src 'self' %s; connect-src 'self'", config.GetImageProxyOrigin(c))) - // add this if need iframe: ; frame-ancestors 'self' + c.Set("Content-Security-Policy", fmt.Sprintf("default-src 'none'; script-src 'self'; style-src 'self'; img-src 'self' %s; connect-src 'self'; form-action 'self'; frame-ancestors 'none'; ", config.GetImageProxyOrigin(c))) + // use this if need iframe: frame-ancestors 'self' return c.Next() })