Skip to content

Commit

Permalink
Update CSP for Jekyll test
Browse files Browse the repository at this point in the history
  • Loading branch information
@philwareham
philwareham committed Jul 15, 2020
1 parent 850f42e commit 6807cdb
Showing 1 changed file with 11 additions and 7 deletions.
18 changes: 11 additions & 7 deletions servers/files/trident.textpattern.com/etc/nginx/sites-available/jekyll.textpattern.com.conf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -45,9 +45,9 @@ server {#http(/1), #https(/2), PHP FastCGI (optional)
set $csp_7fcbbcec '${csp_7fcbbcec}connect-src \'self\';';
set $csp_7fcbbcec '${csp_7fcbbcec}default-src \'none\';';
set $csp_7fcbbcec '${csp_7fcbbcec}font-src https://*.textpattern.com \'self\';';
set $csp_7fcbbcec '${csp_7fcbbcec}frame-ancestors \'self\';';
set $csp_7fcbbcec '${csp_7fcbbcec}frame-src \'none\';';
set $csp_7fcbbcec '${csp_7fcbbcec}img-src https://*.textpattern.com \'self\';';
set $csp_7fcbbcec '${csp_7fcbbcec}form-action \'self\';';
set $csp_7fcbbcec '${csp_7fcbbcec}frame-ancestors \'none\';';
set $csp_7fcbbcec '${csp_7fcbbcec}img-src https://textpattern.com data: \'self\';';
set $csp_7fcbbcec '${csp_7fcbbcec}manifest-src \'self\';';
set $csp_7fcbbcec '${csp_7fcbbcec}media-src \'self\';';
set $csp_7fcbbcec '${csp_7fcbbcec}object-src \'none\';';
Expand All @@ -56,6 +56,10 @@ server {#http(/1), #https(/2), PHP FastCGI (optional)
add_header Content-Security-Policy $csp_7fcbbcec;
#nested variable for Feature Policy maintainability
set $fp_7fcbbcec '';
set $fp_7fcbbcec '${fp_7fcbbcec}accelerometer \'none\';';
set $fp_7fcbbcec '${fp_7fcbbcec}ambient-light-sensor \'none\';';
set $fp_7fcbbcec '${fp_7fcbbcec}autoplay \'none\';';
set $fp_7fcbbcec '${fp_7fcbbcec}battery \'none\';';
set $fp_7fcbbcec '${fp_7fcbbcec}camera \'none\';';
set $fp_7fcbbcec '${fp_7fcbbcec}fullscreen \'self\';';
set $fp_7fcbbcec '${fp_7fcbbcec}geolocation \'none\';';
Expand All @@ -65,15 +69,15 @@ server {#http(/1), #https(/2), PHP FastCGI (optional)
set $fp_7fcbbcec '${fp_7fcbbcec}midi \'none\';';
set $fp_7fcbbcec '${fp_7fcbbcec}notifications \'self\';';
set $fp_7fcbbcec '${fp_7fcbbcec}payment \'none\';';
set $fp_7fcbbcec '${fp_7fcbbcec}push \'self\';';
set $fp_7fcbbcec '${fp_7fcbbcec}picture-in-picture \'none\';';
set $fp_7fcbbcec '${fp_7fcbbcec}speaker \'none\';';
set $fp_7fcbbcec '${fp_7fcbbcec}sync-xhr \'self\';';
set $fp_7fcbbcec '${fp_7fcbbcec}vibrate \'none\''; #no trailing semicolon
set $fp_7fcbbcec '${fp_7fcbbcec}usb \'none\''; #no trailing semicolon
add_header Feature-Policy $fp_7fcbbcec;
add_header Referrer-Policy strict-origin;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload";
add_header X-Content-Type-Options nosniff;
add_header X-Frame-Options SAMEORIGIN;
add_header X-Frame-Options DENY;
add_header X-XSS-Protection "1; mode=block";
error_log /var/log/nginx/jekyll.textpattern.com/jekyll.textpattern.com.error.log warn;
index index.html index.php;
Expand Down Expand Up @@ -111,7 +115,7 @@ server {#http(/1), #https(/2), PHP FastCGI (optional)
add_header Referrer-Policy strict-origin;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload";
add_header X-Content-Type-Options nosniff;
add_header X-Frame-Options SAMEORIGIN;
add_header X-Frame-Options DENY;
add_header X-XSS-Protection "1; mode=block";
}
location / {
Expand Down

2 comments on commit 6807cdb

@petecooper
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@philwareham - what CSP level are we targeting at? frame-src is deprecated in level 2, but we're not using child-src. Level 3 undeprecates it, which is…curious.

Related: we can probably refresh #37 when we're clear(er) on what grade we want to aim for.

@philwareham
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah, I need to have a good sort through the CSP at some point. It seems to change spec constantly.

Please sign in to comment.