search

obl-ong / panel

Multi-tenant domain services built with Ruby on Rails, open source and forever free. Powering the obl.ong domain registry.
https://obl.ong
20 stars 5 forks source link

Add CSP #119

Closed reesericci closed 7 months ago

reesericci commented 7 months ago

This PR makes the necessary changes to add a decent content security policy (with nonces & unsafe-inline for style attributes unfortunately).

reesericci commented 7 months ago

image

However this incorrectly determines that we don't use unsafe-inline, as shown a little further down the page

https://observatory.mozilla.org/analyze/admin.obl.ong

reesericci commented 7 months ago

Can you check that the CSP errors aren't coming from extensions? Also, if you open up the network tag can you get the specific URLs being blocked