Content Security Policy (CSP)

[Bixilon]

Hi there,

how about setting a Content Security Policy by default?

My instance is deployed with:

Content-Security-Policy: base-uri 'self'; default-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self'; img-src: 'self' data:

And works quite well.

[Bios-Marcel]

I think that'd be fine

There's already this middleware:

scribble.rs/internal/frontend/http.go

Line 95 in 406ca18

w.Header().Add("Content-Security-Policy-Report-Only", "default-src 'self'; script-src 'self' 'unsafe-eval' blob:; style-src 'self' 'unsafe-inline' blob:; img-src 'self' data: blob:; media-src 'self' blob: data:")

I guess we could put a default here and allow a config override 🤷

Would you like to make a PR?

[Bixilon]

Oh, did not notice. It contains unsafe-eval, is that really needed? And it is report only. I can make a PR, give me some days :) Kinda busy atm.

[Bios-Marcel]

If i remember correctly, i copied the discord app CSP, since i was trying to integrate it step by step. Report only was quite helpful for that :D

So safer works as long as everything still works I guess. I don't know if we might break existing deployments that use iframes or whatever if we make an aggressive change though 🤔