set manifest-src to 'self' for Element

This commit is contained in:
Daniel Micay 2021-07-03 08:56:02 -04:00
parent b9adc72a0c
commit c98929ea0d

View File

@ -139,7 +139,7 @@ http {
include snippets/security-headers.conf;
add_header Cross-Origin-Resource-Policy "same-origin" always;
add_header Content-Security-Policy "font-src 'self'; script-src 'self' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; frame-ancestors 'self'; block-all-mixed-content" always;
add_header Content-Security-Policy "font-src 'self'; manifest-src 'self'; script-src 'self' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; frame-ancestors 'self'; block-all-mixed-content" always;
# obsolete and replaced with Content-Security-Policy frame-ancestors 'self'
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Robots-Tag "none";