Evolinx/evorepo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add base-uri and frame-ancestors to CSP

Browse Source 
The archweb website contains no <base> elements so this can be
disallowed. Also set frame-ancestors is set to the same value as
X-Frame-Options.

Signed-off-by: Jelle van der Waa <jelle@archlinux.org>
This commit is contained in:
Jelle van der Waa 2019-02-24 17:14:17 +01:00
parent b737f2b4c3
commit aae6e43fcc
1 changed files with 2 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
settings.py
View File

@ -98,6 +98,8 @@
CSP_SCRIPT_SRC = ("'self'",)
CSP_INCLUDE_NONCE_IN = ['script-src']
CSP_IMG_SRC = ("'self'", 'data:',)
CSP_BASE_URI = ("'none'",)
CSP_FRAME_ANCESTORS = ("'none'",)
# Use new test runner
TEST_RUNNER = 'django.test.runner.DiscoverRunner'