mirror of
https://github.com/luxfi/pics.git
synced 2026-10-30 15:22:15 +00:00
Thomas Lynch
b8e9efd77f
Make embeds slightly safer by setting src and not inserting it as part of insertadjacenthtml (yes we have a CSP but lets be even safer) Add background color to embed iframes so they look better while loading Rumble not posible due to their dogshit embed system Close #538
6 lines
711 B
Plaintext
6 lines
711 B
Plaintext
add_header Content-Security-Policy "default-src 'self'; media-src 'self' blob:; img-src 'self' blob:; object-src 'self' blob:; script-src 'self'; style-src 'self' 'unsafe-inline'; frame-src 'self' https://www.youtube-nocookie.com/embed/ https://www.bitchute.com/embed/ https://odysee.com/%24/embed/; connect-src 'self' wss://example.com/ wss://www.example.com/ wss://www.example.onion/ wss://example.onion/ wss://www.example.loki/ wss://example.loki/; font-src 'self'" always;
|
|
add_header Referrer-Policy "same-origin, strict-origin-when-cross-origin" always;
|
|
add_header X-Frame-Options "sameorigin" always;
|
|
add_header X-Content-Type-Options "nosniff" always;
|
|
add_header X-XSS-Protection "1; mode=block" always;
|