Remove unused CSP rules and fix #3

migueldemoura · Mar 12, 2018 · 8985053 · 8985053
1 parent b7b46c8
commit 8985053
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 2 deletions.
diff --git a/_config.yml b/_config.yml
@@ -50,6 +50,6 @@ webrick:
     X-Content-Type-Options: "nosniff"
     X-Frame-Options: "DENY"
     X-XSS-Protection: "1; mode=block"
-    Content-Security-Policy: "default-src 'none'; script-src 'self'; style-src 'self'; img-src 'self'; font-src 'self'; connect-src 'self'; frame-ancestors 'none'; form-action 'none'; block-all-mixed-content; base-uri 'self'; require-sri-for script style"
+    Content-Security-Policy: "default-src 'self'; connect-src 'none'; frame-src 'none'; manifest-src 'none'; media-src 'none'; object-src 'none'; worker-src 'none'; frame-ancestors 'none'; form-action 'none'; block-all-mixed-content; base-uri 'self'"
     Referrer-Policy: "no-referrer"
     Expect-CT: "enforce"
diff --git a/_headers b/_headers
@@ -2,6 +2,6 @@
   X-Content-Type-Options: nosniff
   X-Frame-Options: DENY
   X-XSS-Protection: 1; mode=block
-  Content-Security-Policy: default-src 'none'; script-src 'self'; style-src 'self'; img-src 'self'; font-src 'self'; connect-src 'self'; frame-ancestors 'none'; form-action 'none'; upgrade-insecure-requests; block-all-mixed-content; base-uri 'self'; require-sri-for script style
+  Content-Security-Policy: default-src 'self'; connect-src 'none'; frame-src 'none'; manifest-src 'none'; media-src 'none'; object-src 'none'; worker-src 'none'; frame-ancestors 'none'; form-action 'none'; block-all-mixed-content; base-uri 'self'
   Referrer-Policy: no-referrer
   Expect-CT: enforce