gsadmin/meet
1
0
Fork 0
mirror of https://github.com/suitenumerique/meet.git synced 2026-08-07 01:13:21 +00:00
Code Issues Packages Projects Releases Wiki Activity

✨(frontend) add configurable ministries domains to add-in CSP

Browse Source 
Introduce a variable to define allowed ministries domains in the
CSP configuration for the add-in.

This improves flexibility and avoids hardcoding domain lists.
This commit is contained in:
lebaudantoine
2026-05-06 16:47:51 +02:00
parent 1af58b889e
commit 1e78cc3dab
1 changed files with 3 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docker/dinum-frontend/nginx/default.conf
+3 -2
View File
@@ -45,13 +45,14 @@ server {
add_header Expires 0 always;
set $ms_domains "https://*.live.com https://*.office.com https://*.microsoft.com https://*.office365.com https://*.sharepoint.com https://*.cloud.microsoft";
set $ministries_domains "https://courrieljf.ccomptes.fr";
set $nonce $request_id;
set $csp "upgrade-insecure-requests; ";
set $csp "${csp}frame-ancestors ${ms_domains}; ";
set $csp "${csp}frame-ancestors ${ms_domains} ${ministries_domains}; ";
set $csp "${csp}script-src 'nonce-${nonce}' 'strict-dynamic'; ";
set $csp "${csp}connect-src 'self' ${ms_domains}; ";
set $csp "${csp}connect-src 'self' ${ms_domains} ${ministries_domains}; ";
set $csp "${csp}frame-src 'none'; ";
set $csp "${csp}object-src 'none'; ";
set $csp "${csp}base-uri 'none'; ";