Move CSP to config

2026-03-20 08:21:40 +01:00
parent fdd7f784d0
commit 5b43c9e5bd
3 changed files with 5 additions and 1 deletions
--- a/3
+++ b/3
@@ -431,6 +431,9 @@
 # Additional HTTP headers
 #Access-Control-Allow-Origin = *

+# Set CSP to disallow execution of unknown javascript
+# This may become the default in future versions, override if you need a different CSP.
+Content-Security-Policy = default-src 'self'; object-src 'none'

 [hook]