Document CSP

diff --git a/README.md b/README.md
index b5eb778d79bbd5a84e0ade0976b2f241e4c00b10..905c4322956e0dc021dc151bdd983e6742130a21 100644 (file)
--- a/README.md
+++ b/README.md
@@ -135,7 +135,20 @@ We will assume www-data is the UNIX user of your Web server. Adapt if necessary.
         exec sudo -u www-data DEBUG_LOG=true nodejs trivabble-server.js
         ```
 
-8. Configure your web server. In the next two sections, we describe the configuration for Apache 2 and Nginx.
+8. Configure your web server.
+
+#### Content-Security Policy Header
+
+Trivabble loads 5 static javascript files, 2 static css files and a sound from its origin, and connects to the same server by SSE or websockets.
+Here is the recommended HTTP CSP header for Trivabble:
+
+```
+Content-Security-Policy: default-src 'none'; script-src 'self'; style-src 'self'; img-src 'self'; connect-src 'self'; media-src 'self'
+```
+
+We advise you to set this up to improve the security of your setup.
+
+In the next two sections, we describe the configuration for Apache 2 and Nginx.
 
 #### Apache 2