browse: fix Content-Security-Policy warnings in Firefox (#6443)

* Remove 'strict-dynamic' + block-all-mixed-content * CSP: remove 'unsafe-inline' from script-src

Steffen Busch committed Jul 7, 2024 at 14:56 UTC 88c7e53da55e23c113d4d1f2b67ddf8b978e8a45

1 file changed +1 -1

modules/caddyhttp/fileserver/browse.html

+1 -1

@@ -1,6 +1,6 @@

1 {{ $nonce := uuidv4 -}}

2 {{ $nonceAttribute := print "nonce=" (quote $nonce) -}}

3 -{{ $csp := printf "default-src 'none'; img-src 'self'; object-src 'none'; base-uri 'none'; script-src 'strict-dynamic' 'nonce-%s' 'unsafe-inline' https: http:; style-src 'strict-dynamic' 'nonce-%s'; frame-ancestors 'self'; form-action 'self'; block-all-mixed-content;" $nonce $nonce -}}

3 +{{ $csp := printf "default-src 'none'; img-src 'self'; object-src 'none'; base-uri 'none'; script-src 'nonce-%s'; style-src 'nonce-%s'; frame-ancestors 'self'; form-action 'self';" $nonce $nonce -}}

4 {{/* To disable the Content-Security-Policy, set this to false */}}{{ $enableCsp := true -}}

5 {{ if $enableCsp -}}

6 {{- .RespHeader.Set "Content-Security-Policy" $csp -}}