stroblmeandClaude Opus 5.5
6c0ab2049b
script-src admits the bundle and the pre-paint theme script by hash, with no unsafe-inline or unsafe-eval; style-src keeps unsafe-inline for the <style> elements Monaco, Radix and the toasts insert. frame-ancestors 'self', nosniff and strict-origin-when-cross-origin go with it, and the Dockerfile adds the API origin to connect-src when the bundle calls one elsewhere. Zod runs jitless so its eval probe is not reported on every page. The embed widget keeps allow-same-origin: the demo's weather map does not render without it; the comment now says so and what it costs. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013GAeg4Jo6xjZzjwy9QDWMQ
15 lines
1.2 KiB
Plaintext
15 lines
1.2 KiB
Plaintext
# Security headers. Included at server level and again in every location with
|
|
# an add_header of its own, since nginx drops the inherited ones there.
|
|
#
|
|
# script-src: the bundle, plus the theme script inline in index.html by its
|
|
# hash. Edit that script and this hash must change with it (sha256 of the text
|
|
# between the tags, base64), or the app paints light-then-dark again.
|
|
# style-src 'unsafe-inline': Monaco, Radix's scroll lock and the toasts insert
|
|
# <style> elements at runtime, which no hash can name.
|
|
# img/frame-src take any http(s): a camera stream or website widget points
|
|
# wherever its dashboard says. connect-src is this origin plus the API's when
|
|
# the bundle calls one elsewhere; the Dockerfile fills that in.
|
|
add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'sha256-FpmE/jXgh7LaQmoMHvqlYVa3hl7+cMNkDN2fSejs9So='; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: http: https:; media-src 'self' blob:; font-src 'self'; connect-src 'self'__API_ORIGINS__; worker-src 'self'; frame-src http: https:; frame-ancestors 'self'; object-src 'none'; base-uri 'self'; form-action 'self'" always;
|
|
add_header X-Content-Type-Options "nosniff" always;
|
|
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
|