Infrastructure/ansible
1
0
Fork 0
Code Issues Pull requests 6 Projects Releases Packages Wiki Activity Actions

Pagure: only set the CSP headers in production, in staging use the application ones

Browse source 
Signed-off-by: Pierre-Yves Chibon <pingou@pingoured.fr>
This commit is contained in:
Pierre-Yves Chibon 2019-07-08 13:31:43 +02:00
parent a9e8c10abe
commit 3d9a2d8251
1 changed files with 2 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

2
roles/pagure/frontend/templates/securityheaders.conf
View file

@ -2,4 +2,6 @@ Header always set X-Frame-Options "ALLOW-FROM https://pagure.io/"
Header always set X-Xss-Protection "1; mode=block" Header always set X-Xss-Protection "1; mode=block"
Header always set X-Content-Type-Options "nosniff" Header always set X-Content-Type-Options "nosniff"
Header always set Referrer-Policy "same-origin" Header always set Referrer-Policy "same-origin"
{% if env != 'pagure-staging' %}
Header always set Content-Security-Policy "default-src 'self' https:; script-src 'self' 'unsafe-eval' 'unsafe-inline' https://apps.fedoraproject.org; style-src 'self' 'unsafe-inline' https://apps.fedoraproject.org" Header always set Content-Security-Policy "default-src 'self' https:; script-src 'self' 'unsafe-eval' 'unsafe-inline' https://apps.fedoraproject.org; style-src 'self' 'unsafe-inline' https://apps.fedoraproject.org"
{% endif %}