mirror of https://github.com/status-im/codimd.git
CSP: Upgrade insecure requests if possible
Config option; default is to only upgrade if usessl
This commit is contained in:
parent
ba183ce654
commit
5d2d3ec875
5
app.js
5
app.js
|
@ -126,6 +126,11 @@ if (config.csp.enable) {
|
|||
directives[propertyName] = directive;
|
||||
}
|
||||
}
|
||||
if(config.csp.upgradeInsecureRequests === 'auto') {
|
||||
directives.upgradeInsecureRequests = config.usessl === 'true'
|
||||
} else {
|
||||
directives.upgradeInsecureRequests = config.csp.upgradeInsecureRequests === 'true'
|
||||
}
|
||||
app.use(helmet.contentSecurityPolicy({
|
||||
directives: directives
|
||||
}))
|
||||
|
|
|
@ -20,8 +20,9 @@ module.exports = {
|
|||
defaultSrc: ["'self'"],
|
||||
scriptSrc: ["'self'"],
|
||||
styleSrc: ["'self'", "'unsafe-inline'"],
|
||||
fontSrc: ["'self'"]
|
||||
}
|
||||
fontSrc: ["'self'"],
|
||||
},
|
||||
upgradeInsecureRequests: 'auto'
|
||||
},
|
||||
protocolusessl: false,
|
||||
usecdn: true,
|
||||
|
|
Loading…
Reference in New Issue