diff options
Diffstat (limited to 'internal/middleware/contentsecuritypolicy.go')
| -rw-r--r-- | internal/middleware/contentsecuritypolicy.go | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/internal/middleware/contentsecuritypolicy.go b/internal/middleware/contentsecuritypolicy.go index 5984a75c3..fb35c3a08 100644 --- a/internal/middleware/contentsecuritypolicy.go +++ b/internal/middleware/contentsecuritypolicy.go @@ -40,6 +40,7 @@ func BuildContentSecurityPolicy(extraURIs ...string) string { objectSrc = "object-src" imgSrc = "img-src" mediaSrc = "media-src" + frames = "frame-ancestors" self = "'self'" none = "'none'" @@ -103,6 +104,14 @@ func BuildContentSecurityPolicy(extraURIs ...string) string { ) /* + frame-ancestors + https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/frame-ancestors + */ + + // Don't allow embedding us in an iframe + values[frames] = []string{none} + + /* Assemble policy directives. */ |