diff options
Diffstat (limited to 'include')
| -rw-r--r-- | include/security_headers_middleware.hpp | 18 |
1 files changed, 11 insertions, 7 deletions
diff --git a/include/security_headers_middleware.hpp b/include/security_headers_middleware.hpp index 1ebc43ca7a..83df24c194 100644 --- a/include/security_headers_middleware.hpp +++ b/include/security_headers_middleware.hpp @@ -37,19 +37,23 @@ struct SecurityHeadersMiddleware res.addHeader(bf::pragma, "no-cache"); res.addHeader(bf::cache_control, "no-Store,no-Cache"); - // The KVM currently needs to load images from base64 encoded strings. - // img-src 'self' data: is used to allow that. + res.addHeader("Content-Security-Policy", "default-src 'none'; " + "img-src 'self' data:; " + "font-src 'self'; " + "style-src 'self'; " + "script-src 'self'; " + "connect-src 'self' wss:"); + // The KVM currently needs to load images from base64 encoded + // strings. img-src 'self' data: is used to allow that. // https://stackoverflow.com/questions/18447970/content-security-policy-data-not-working-for-base64-images-in-chrome-28 - res.addHeader("Content-Security-Policy", - "default-src 'self'; img-src 'self' data:"); + res.addHeader("X-XSS-Protection", "1; " "mode=block"); res.addHeader("X-Content-Type-Options", "nosniff"); - res.addHeader("X-UA-Compatible", "IE=11"); #ifdef BMCWEB_INSECURE_DISABLE_XSS_PREVENTION - - res.addHeader(bf::access_control_allow_origin, "http://localhost:8080"); + res.addHeader(bf::access_control_allow_origin, + req.getHeaderValue("Origin")); res.addHeader(bf::access_control_allow_methods, "GET, " "POST, " "PUT, " |