From c98929ea0d112ae5207e3b735b4aa71367afd94a Mon Sep 17 00:00:00 2001 From: Daniel Micay Date: Sat, 3 Jul 2021 08:56:02 -0400 Subject: [PATCH] set manifest-src to 'self' for Element --- nginx/nginx.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nginx/nginx.conf b/nginx/nginx.conf index ddc90b2..0583b19 100644 --- a/nginx/nginx.conf +++ b/nginx/nginx.conf @@ -139,7 +139,7 @@ http { include snippets/security-headers.conf; add_header Cross-Origin-Resource-Policy "same-origin" always; - add_header Content-Security-Policy "font-src 'self'; script-src 'self' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; frame-ancestors 'self'; block-all-mixed-content" always; + add_header Content-Security-Policy "font-src 'self'; manifest-src 'self'; script-src 'self' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; frame-ancestors 'self'; block-all-mixed-content" always; # obsolete and replaced with Content-Security-Policy frame-ancestors 'self' add_header X-Frame-Options "SAMEORIGIN" always; add_header X-Robots-Tag "none";