From bc0cfa3d288f7e6131efbb6f4f12b4e4a57e4d07 Mon Sep 17 00:00:00 2001 From: Ivan Gabaldon Date: Mon, 18 Aug 2025 21:59:55 +0200 Subject: [PATCH] [mod] caddy: update csp (#424) Since https://github.com/searxng/searxng/pull/5073 we add a script directly to the [`base.html`](https://github.com/searxng/searxng/blob/master/searx/templates/simple/base.html), we need `'unsafe-inline'`. --- Caddyfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Caddyfile b/Caddyfile index f6725e9..30f09ae 100644 --- a/Caddyfile +++ b/Caddyfile @@ -52,7 +52,7 @@ encode zstd gzip header { # CSP (https://content-security-policy.com) - Content-Security-Policy "upgrade-insecure-requests; default-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; form-action 'self' https:; font-src 'self'; frame-ancestors 'self'; base-uri 'self'; connect-src 'self'; img-src * data:; frame-src https:;" + Content-Security-Policy "upgrade-insecure-requests; default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; form-action 'self' https:; font-src 'self'; frame-ancestors 'self'; base-uri 'self'; connect-src 'self'; img-src * data:; frame-src https:;" # Disable browser features Permissions-Policy "accelerometer=(),camera=(),geolocation=(),gyroscope=(),magnetometer=(),microphone=(),payment=(),usb=()"