David Anderson db800ddeac cmd/derper: set Content-Security-Policy on DERPs. ...

It's a basic "deny everything" policy, since DERP's HTTP
server is very uninteresting from a browser POV. But it
stops every security scanner under the sun from reporting
"dangerously configured" HTTP servers.

Updates tailscale/corp#3119

Signed-off-by: David Anderson <danderson@tailscale.com>

2021-11-26 11:00:44 -08:00

..

bootstrap_dns.go

cmd/derper: add /bootstrap-dns handler

2021-02-26 09:29:28 -08:00

cert.go

cmd/derper: support manual TLS certificate mode (#2793)

2021-09-08 16:50:34 -07:00

derper_test.go

cmd/derper: refactor STUN path for testing, add serverSTUN benchmark

2021-09-13 10:12:32 -07:00

derper.go

cmd/derper: set Content-Security-Policy on DERPs.

2021-11-26 11:00:44 -08:00

mesh.go

derp: use new node key type.

2021-10-28 16:02:11 -07:00

websocket.go

cmd/derper, derp/derphttp: add websocket support

2021-10-22 12:51:30 -07:00