TheArchive/tailscale
1
0
Fork 0
mirror of https://github.com/tailscale/tailscale.git synced 2025-03-29 04:22:24 +00:00
Code Issues Packages Projects Releases Wiki Activity

client/web: remove 'unsafe-inline' from CSP

Browse Source 
I seem to recall I needed this for things to work properly with the vite
dev server, but that doesn't seem to be the case anymore?  Everything
seems to work fine without it.  If we still have issues, we'll need to
look into using a nonce or integrity attribute.

Updates 
Fixes 

Signed-off-by: Will Norris <will@tailscale.com>
This commit is contained in:
Will Norris 2023-12-11 09:49:00 -08:00 committed by Will Norris
parent c2fe123232
commit 970dc2a976
1 changed files with 1 additions and 1 deletions

2
client/web/web.go

@ -253,7 +253,7 @@ func (s *Server) serve(w http.ResponseWriter, r *http.Request) {
if !s.devMode {
w.Header().Set("X-Frame-Options", "DENY")
// TODO: use CSP nonce or hash to eliminate need for unsafe-inline
w.Header().Set("Content-Security-Policy", "default-src 'self' 'unsafe-inline'; img-src * data:")
w.Header().Set("Content-Security-Policy", "default-src 'self'; img-src * data:")
w.Header().Set("Cross-Origin-Resource-Policy", "same-origin")
}
}