gsadmin/KoalaSync
1
0
Fork 0
mirror of https://github.com/Shik3i/KoalaSync.git synced 2026-08-13 13:07:12 +00:00
Code Issues Packages Projects Releases Wiki Activity

security(website): refactor inline scripts and click handlers to external files to achieve 100% strict CSP compliance

Browse Source
This commit is contained in:
Timo
2026-05-18 21:21:38 +02:00
parent 44ee3fab25
commit aa1382b2ad
8 changed files with 99 additions and 102 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Caddyfile.example
+1 -1
View File
@@ -17,7 +17,7 @@ sync.koalastuff.net {
# Security Headers & Content Security Policy (CSP)
header {
# Strict Content Security Policy (restricts scripts and connections to self, forbids frames)
Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; connect-src 'self'; img-src 'self' data:; object-src 'none'; frame-ancestors 'none';"
Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; connect-src 'self'; img-src 'self' data:; object-src 'none'; frame-ancestors 'none';"
# Prevent FLoC tracking
Permissions-Policy interest-cohort=()
# Security best practices