From 10c12f97a4b1fe66126f6a7a5973c98272abac0e Mon Sep 17 00:00:00 2001 From: =?utf8?q?Rapha=C3=ABl=20Jakse?= Date: Fri, 9 Oct 2020 00:14:57 +0200 Subject: [PATCH] Document CSP --- README.md | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index b5eb778..905c432 100644 --- a/README.md +++ b/README.md @@ -135,7 +135,20 @@ We will assume www-data is the UNIX user of your Web server. Adapt if necessary. exec sudo -u www-data DEBUG_LOG=true nodejs trivabble-server.js ``` -8. Configure your web server. In the next two sections, we describe the configuration for Apache 2 and Nginx. +8. Configure your web server. + +#### Content-Security Policy Header + +Trivabble loads 5 static javascript files, 2 static css files and a sound from its origin, and connects to the same server by SSE or websockets. +Here is the recommended HTTP CSP header for Trivabble: + +``` +Content-Security-Policy: default-src 'none'; script-src 'self'; style-src 'self'; img-src 'self'; connect-src 'self'; media-src 'self' +``` + +We advise you to set this up to improve the security of your setup. + +In the next two sections, we describe the configuration for Apache 2 and Nginx. #### Apache 2 -- 2.30.2