Content Security Policy

[nicheosala]

Feature Description

This is the HTTP header of the Content Security Policy that I am currently leveraging for my Gitea instance:

default-src 'none'; connect-src 'self'; font-src 'self' data:; form-action 'self'; img-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; worker-src 'self'

According to CSP Evaluator, this is a good policy, with the exception of the script-src 'unsafe-inline' rule, the presence of which is classified like: "High severity finding" (and for good reason).

I know that eliminating that rule is not easy at all. I have encountered many GitHub issues regarding Gitea's CSP.

However, in my opinion, it would be a good idea to write a web page showing the best CSP policy available for Gitea.

If you can suggest a more restrictive policy than the one above, which does not compromise the functioning of Gitea, the advice is very welcome.

Screenshots

No response

[silverwind]

Duplicate of #305