From 1fb9df08ab3f4e4f6b3520e72bced4173d788822 Mon Sep 17 00:00:00 2001 From: Arya Kiran Date: Thu, 21 Sep 2023 23:42:28 +0530 Subject: [PATCH] unsafe-inline for scripts as well --- serve/serve.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/serve/serve.go b/serve/serve.go index 1774957..9303271 100644 --- a/serve/serve.go +++ b/serve/serve.go @@ -78,7 +78,7 @@ func Serve(port string) { c.Set("X-XSS-Protection", "1; mode=block") c.Set("X-Content-Type-Options", "nosniff") c.Set("Referrer-Policy", "no-referrer") - c.Set("Content-Security-Policy", "default-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; script-src 'self'; frame-ancestors 'self'; form-action 'self'; base-uri 'self'; connect-src 'self';") + c.Set("Content-Security-Policy", "default-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; script-src 'self' 'unsafe-inline'; frame-ancestors 'self'; form-action 'self'; base-uri 'self'; connect-src 'self';") c.Set("Strict-Transport-Security", "max-age=31536000; includeSubDomains; preload") return c.Next() })