aljaz/btcpayserver
1
0
Fork 0
mirror of https://github.com/aljazceru/btcpayserver.git synced 2026-01-06 07:34:26 +01:00
Code Issues Packages Projects Releases Wiki Activity

Add CSP at the website level (#2863)

Browse Source
This commit is contained in:
Nicolas Dorier
2021-09-09 21:51:28 +09:00
committed by GitHub
parent c39f1341aa
commit fc4e47cec6
9 changed files with 224 additions and 90 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
BTCPayServer/Hosting/Startup.cs
View File

@@ -114,14 +114,8 @@ namespace BTCPayServer.Hosting
o.Filters.Add(new XXSSProtectionAttribute());
o.Filters.Add(new ReferrerPolicyAttribute("same-origin"));
o.ModelBinderProviders.Insert(0, new ModelBinders.DefaultModelBinderProvider());
//o.Filters.Add(new ContentSecurityPolicyAttribute()
//{
// FontSrc = "'self' https://fonts.gstatic.com/",
// ImgSrc = "'self' data:",
// DefaultSrc = "'none'",
// StyleSrc = "'self' 'unsafe-inline'",
// ScriptSrc = "'self' 'unsafe-inline'"
//});
if (!Configuration.GetOrDefault<bool>("nocsp", false))
o.Filters.Add(new ContentSecurityPolicyAttribute(CSPTemplate.AntiXSS));
})
.ConfigureApiBehaviorOptions(options =>
{