From 9bc593d6753922d995867b632477d4d3b9e86e20 Mon Sep 17 00:00:00 2001 From: beatrix-bitrot Date: Sun, 14 May 2017 20:56:30 +0000 Subject: update local modifications for cors and cp --- config/environments/production.rb | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) (limited to 'config/environments/production.rb') diff --git a/config/environments/production.rb b/config/environments/production.rb index bd87d79a7..68229531d 100644 --- a/config/environments/production.rb +++ b/config/environments/production.rb @@ -93,9 +93,12 @@ Rails.application.configure do end config.action_dispatch.default_headers = { - 'Server' => 'Mastodon', - 'X-Frame-Options' => 'DENY', - 'X-Content-Type-Options' => 'nosniff', - 'X-XSS-Protection' => '1; mode=block', + 'Server' => 'Mastodon', + 'X-Frame-Options' => 'DENY', + 'X-Content-Type-Options' => 'nosniff', + 'X-XSS-Protection' => '1; mode=block', + 'Content-Security-Policy' => "frame-ancestors 'none'; object-src 'none'; script-src 'self' https://dev-static.glitch.social 'unsafe-inline'; base-uri 'none';" , + 'Referrer-Policy' => 'no-referrer, strict-origin-when-cross-origin', + 'Strict-Transport-Security' => 'max-age=63072000; includeSubDomains; preload' } end -- cgit