From 3e3eb450743ccf02c8b4349ed769481414690a67 Mon Sep 17 00:00:00 2001 From: =?utf8?q?Andreas=20Pinto-K=C3=B6hler?= Date: Wed, 2 Nov 2016 16:10:16 +0100 Subject: [PATCH] Added CSP Header directive and sources. --- customer/mbvd-ngcc/dev-web-ngcc-daimler.pixelpark.net.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/customer/mbvd-ngcc/dev-web-ngcc-daimler.pixelpark.net.yaml b/customer/mbvd-ngcc/dev-web-ngcc-daimler.pixelpark.net.yaml index 75d757b0..4d1a030f 100644 --- a/customer/mbvd-ngcc/dev-web-ngcc-daimler.pixelpark.net.yaml +++ b/customer/mbvd-ngcc/dev-web-ngcc-daimler.pixelpark.net.yaml @@ -41,8 +41,8 @@ site::profile::apache::pp_vhosts: - 'set X-Content-Type-Options: nosniff' - 'set X-XSS-Protection: "1; mode=block"' - 'set X-Frame-Options: "ALLOW-FROM https://dev-cms01-ngcc-daimler.pixelpark.net"' - - "set Content-Security-Policy: \"default-src 'self'; font-src 'self'; style-src 'self' 'unsafe-inline'; frame-ancestors 'self'\"" - - "set X-Content-Security-Policy: \"default-src 'self'; font-src 'self'; style-src 'self' 'unsafe-inline'; frame-ancestors 'self'\"" + - "set Content-Security-Policy: \"default-src 'self'; font-src 'self' data:; style-src 'self' 'unsafe-inline'; frame-ancestors 'self'; media-src 'self' data:\"" + - "set X-Content-Security-Policy: \"default-src 'self'; font-src 'self' data:; style-src 'self' 'unsafe-inline'; frame-ancestors 'self'; media-src 'self' data:\"" headers_ssl: - 'always set Strict-Transport-Security "max-age=31556926"' custom_fragment: | -- 2.39.5