When ssl is enabled only allow https content within the site

2016-10-31 10:42:03 +00:00 · 2016-10-31 10:42:03 +00:00 · 5a12545657
parent a1de6ba0c8
commit 5a12545657
1 changed files with 1 additions and 0 deletions
--- a/src/freedombone-utils-web
+++ b/src/freedombone-utils-web
@ -134,6 +134,7 @@ function nginx_ssl {
    echo '    ssl_prefer_server_ciphers on;' >> $filename
    echo "    ssl_protocols $SSL_PROTOCOLS;" >> $filename
    echo "    ssl_ciphers '$SSL_CIPHERS';" >> $filename
+    echo "    add_header Content-Security-Policy \"default-src https:; script-src https: 'unsafe-inline'; style-src https: 'unsafe-inline'\";" >> $filename
    #nginx_stapling $1
 }