From 72867fe3fb654b0d62f20f75cac937c35899f1c8 Mon Sep 17 00:00:00 2001 From: Sami Samhuri Date: Mon, 10 Sep 2018 20:55:37 -0700 Subject: [PATCH] add Content-Security-Policy header --- public/.htaccess | 3 +++ 1 file changed, 3 insertions(+) diff --git a/public/.htaccess b/public/.htaccess index 1e51da7..52dc021 100644 --- a/public/.htaccess +++ b/public/.htaccess @@ -35,6 +35,9 @@ Header set X-Content-Type-Options "nosniff" # Block site from being framed Header set X-Frame-Options "DENY" +# Content Security Policy generated by Mozilla's CSP Toolkit +Header set Content-Security-Policy "default-src 'none'; img-src 'self' https://p.typekit.net; script-src 'self' 'unsafe-inline' https://ajax.googleapis.com https://api.github.com https://gist.github.com https://use.typekit.net; style-src 'unsafe-inline' https://assets-cdn.github.com https://netdna.bootstrapcdn.com" + ################ ### Rewrites ### ################