improved CSP to contain form-action and experimental require-sri-for

syseleven · Jan 8, 2018 · 2eef6cd · 2eef6cd
1 parent 1fc8b4b
commit 2eef6cd
Showing 1 changed file with 3 additions and 3 deletions.
diff --git a/README.md b/README.md
@@ -68,13 +68,13 @@ server {
 
 Furthermore the following HTTP headers have to be set (Nginx example):
 ```
-add_header Content-Security-Policy   "default-src 'self'; frame-ancestors 'self'";
+add_header Content-Security-Policy   "default-src 'self'; form-action 'self'; frame-ancestors 'self'; require-sri-for script style";
 add_header Referrer-Policy           "same-origin";
 add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload";
-add_header X-Content-Security-Policy "default-src 'self'; frame-ancestors 'self'";
+add_header X-Content-Security-Policy "default-src 'self'; form-action 'self'; frame-ancestors 'self'; require-sri-for script style";
 add_header X-Content-Type-Options    "nosniff";
 add_header X-Frame-Options           "SAMEORIGIN";
-add_header X-Webkit-CSP              "default-src 'self'; frame-ancestors 'self'";
+add_header X-Webkit-CSP              "default-src 'self'; form-action 'self'; frame-ancestors 'self'; require-sri-for script style";
 add_header X-XSS-Protection          "1; mode=block";
 ```