Update Content-Security-Policy for enhanced security and resource loading

This commit is contained in:
Tudor Stanciu 2025-09-29 00:48:19 +03:00
parent 06cee54e92
commit fa9bebe9ac

View File

@ -43,7 +43,7 @@ http {
add_header X-XSS-Protection "1; mode=block" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "no-referrer-when-downgrade" always;
add_header Content-Security-Policy "default-src 'self' http: https: data: blob: 'unsafe-inline'" always;
add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self'; connect-src 'self' http: https:;" always;
# Static assets caching - works for any subfolder or root
location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff|woff2)$ {