From: Raphaël Jakse <raphael.trivabble@jakse.fr>
Date: Thu, 8 Oct 2020 22:14:57 +0000 (+0200)
Subject: Document CSP
X-Git-Url: https://secure.softndesign.org/git/?a=commitdiff_plain;h=10c12f97a4b1fe66126f6a7a5973c98272abac0e;p=trivabble.git

Document CSP
---

diff --git a/README.md b/README.md
index b5eb778..905c432 100644
--- a/README.md
+++ b/README.md
@@ -135,7 +135,20 @@ We will assume www-data is the UNIX user of your Web server. Adapt if necessary.
         exec sudo -u www-data DEBUG_LOG=true nodejs trivabble-server.js
         ```
 
-8. Configure your web server. In the next two sections, we describe the configuration for Apache 2 and Nginx.
+8. Configure your web server.
+
+#### Content-Security Policy Header
+
+Trivabble loads 5 static javascript files, 2 static css files and a sound from its origin, and connects to the same server by SSE or websockets.
+Here is the recommended HTTP CSP header for Trivabble:
+
+```
+Content-Security-Policy: default-src 'none'; script-src 'self'; style-src 'self'; img-src 'self'; connect-src 'self'; media-src 'self'
+```
+
+We advise you to set this up to improve the security of your setup.
+
+In the next two sections, we describe the configuration for Apache 2 and Nginx.
 
 #### Apache 2