Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

CSS and JS files aren't load by the twig templates #150

Closed
ALECSQY opened this issue Jun 7, 2017 · 1 comment
Closed

CSS and JS files aren't load by the twig templates #150

ALECSQY opened this issue Jun 7, 2017 · 1 comment

Comments

@ALECSQY
Copy link

ALECSQY commented Jun 7, 2017

Hello,

I'm new with this bundle, it's the first time I use it. Iupload and install it in my project -Symfony 3.2- and after installing the config.yml, l lost the link with my assets(CSS, JS, IMG...).

What happened ? Here my config:

`nelmio_security:
# signs/verifies all cookies
signed_cookie:
names: ['']
# prevents framing of the entire site
clickjacking:
paths:
'^/.
': DENY
# prevents redirections outside the website's domain
external_redirects:
abort: true
log: true

# prevents inline scripts, unsafe eval, external scripts/images/styles/frames, etc
csp:
    hosts: []
    content_types: []
    enforce:
        level1_fallback: false
        browser_adaptive:
            enabled: false
        report-uri: %router.request_context.base_url%/nelmio/csp/report
        default-src:
            - 'none'
        script-src:
            - 'self'
        block-all-mixed-content: true # defaults to false, blocks HTTP content over HTTPS transport
        # upgrade-insecure-requests: true # defaults to false, upgrades HTTP requests to HTTPS transport

# disables content type sniffing for script resources
content_type:
    nosniff: false

# forces Microsoft's XSS-Protection with
# its block mode
xss_protection:
    enabled: true
    mode_block: true

# Send a full URL in the `Referer` header when performing a same-origin request,
# only send the origin of the document to secure destination (HTTPS->HTTPS),
# and send no header to a less secure destination (HTTPS->HTTP).
# If `strict-origin-when-cross-origin` is not supported, use `no-referrer` policy,
# no referrer information is sent along with requests.
referrer_policy:
    enabled: true
    policies:
        - 'no-referrer'
        - 'strict-origin-when-cross-origin'

`

@ALECSQY
Copy link
Author

ALECSQY commented Jun 9, 2017

Resolved,

I'd chosen the maximum security level, whik transform your website in Fort Knox. Adding directives with the URL and 'unsafe-inline', all is good now.

@ALECSQY ALECSQY closed this as completed Jun 9, 2017
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant