From b6bf9bee20ad41e364b1b396f7a02fc6366b7265 Mon Sep 17 00:00:00 2001 From: DL6ER Date: Wed, 20 Nov 2019 15:22:07 +0100 Subject: [PATCH] Add Content-Security-Policy header to resolve CPS issues seen in Firefox when hosted on a machine different than localhost. The critical part is 'unsafe-inline' which is necessary for the inline Javascript found in index.html. Signed-off-by: DL6ER --- src/api/http-common.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/api/http-common.c b/src/api/http-common.c index d0d5aeff..3060897d 100644 --- a/src/api/http-common.c +++ b/src/api/http-common.c @@ -312,6 +312,7 @@ void http_init(void) "decode_url", "no", "num_threads", "4", "access_control_list", httpsettings.acl, + "additional_header", "Content-Security-Policy: default-src 'self' 'unsafe-inline';", NULL }; @@ -400,4 +401,4 @@ int http_method(struct mg_connection *conn) { return HTTP_UNKNOWN; } -} \ No newline at end of file +}