Commit b5dd05ad authored by Jesse Norell's avatar Jesse Norell
Browse files

Add Content-Security-Policy header and friends.

parent 06cf8f6e
......@@ -88,7 +88,13 @@ NameVirtualHost *:<tmpl_var name="vhost_port">
<IfModule mod_headers.c>
Header setifempty add Strict-Transport-Security "max-age=15768000"
# ISPConfig 3.1 currently requires unsafe-line for both scripts and styles, as well as unsafe-eval
Header set Content-Security-Policy "default-src 'self' 'unsafe-inline' 'unsafe-eval'; img-src 'self' data:; object-src 'none'; upgrade-insecure-requests"
Header set X-Content-Type-Options: nosniff
Header set X-Frame-Options: SAMEORIGIN
Header set X-XSS-Protection: "1; mode=block"
Header always edit Set-Cookie (.*) "$1; HTTPOnly; Secure"
Header setifempty Strict-Transport-Security "max-age=15768000"
RequestHeader unset Proxy early
Supports Markdown
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment