Add Content Security Policy (CSP)

vexim · Apr 15, 2017 · e7b39af · e7b39af
1 parent 756fc7f
commit e7b39af
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 0 deletions.
diff --git a/vexim/config/httpheaders.php b/vexim/config/httpheaders.php
@@ -2,4 +2,5 @@
   session_start();
   header("Cache-control: private"); // IE6 hack to back forms + BACK button work
   header("Content-Type: text/html; charset=utf-8");
+  if (isset($CSPenabled) && $CSPenabled === true)  header("Content-Security-Policy: default-src 'self';");
 ?>
diff --git a/vexim/config/variables.php.example b/vexim/config/variables.php.example
@@ -51,6 +51,10 @@
   */
   $passwordstrengthcheck = 1;
 
+  /* Enable Content Security Policy (CSP) to prevent cross-site scripting
+     and other code-injection attacks. */
+  $CSPenabled = false;
+
   /* The UID's and GID's control the default UID and GID for new domains
      and if postmasters can define their own.
      THE UID AND GID MUST BE NUMERIC! */