x/website/cmd/golangorg: Add Content Security Policy

golang / go

The Go programming language

https://go.dev

BSD 3-Clause "New" or "Revised" License

124.17k stars 17.69k forks source link

Open empijei opened 4 years ago

empijei commented 4 years ago

CSP is an important protection against some of the higher risk web vulnerabilities and the official Go website doesn't currently adopt it.

Moreover CSP is a internal requirement for any website hosted on *.google.eTLD and the Go website is currently also hosted on golang.google.cn.

I can take care of fixing this or finding someone that can work on it if the proposal is accepted.

/cc @dmitshur @andybons

andybons commented 4 years ago

This doesn't need a proposal. Feel free to submit a fix :)