mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2025-11-02 11:18:09 +00:00
Kevin Veen-Birkenbach
57d5269b07
- Add CSP3 support for style/script: include -elem and -attr directives - Base (style-src, script-src) now unions elem/attr (CSP2/Safari fallback) - Respect explicit base disables (e.g. style-src.unsafe-inline: false) - Hashes only when 'unsafe-inline' absent in the final base tokens - Nginx: set CSP only for HTML/worker via header_filter_by_lua_block; drop for subresources - Remove per-location header_filter; keep body_filter only - Update app role flags to *-attr where appropriate; extend desktop CSS sources - Add comprehensive unit tests for union/explicit-disable/no-mirror-back Ref: https://chatgpt.com/share/68f87a0a-cebc-800f-bb3e-8c8ab4dee8ee
34 lines
1.2 KiB
Django/Jinja
34 lines
1.2 KiB
Django/Jinja
# ===== Content Security Policy: only for documents and workers (no locations needed) =====
|
|
|
|
# 1) Define your CSP once (Jinja: escape double quotes to be safe)
|
|
set $csp "{{ applications | build_csp_header(application_id, domains) | replace('\"','\\\"') }}";
|
|
|
|
# 2) Send CSP ONLY for document responses; also for workers via Sec-Fetch-Dest
|
|
header_filter_by_lua_block {
|
|
local ct = ngx.header.content_type or ngx.header["Content-Type"] or ""
|
|
local dest = ngx.var.http_sec_fetch_dest or ""
|
|
|
|
local lct = ct:lower()
|
|
local is_html = lct:find("^text/html") or lct:find("^application/xhtml+xml")
|
|
local is_worker = (dest == "worker") or (dest == "serviceworker")
|
|
|
|
if is_html or is_worker then
|
|
ngx.header["Content-Security-Policy"] = ngx.var.csp
|
|
else
|
|
ngx.header["Content-Security-Policy"] = nil
|
|
ngx.header["Content-Security-Policy-Report-Only"] = nil
|
|
end
|
|
|
|
-- If you'll modify the body later, drop Content-Length on HTML
|
|
if is_html then
|
|
ngx.ctx.is_html = true
|
|
ngx.header.content_length = nil
|
|
else
|
|
ngx.ctx.is_html = false
|
|
end
|
|
}
|
|
|
|
# 3) Prevent upstream/app CSP (duplicates)
|
|
proxy_hide_header Content-Security-Policy;
|
|
proxy_hide_header Content-Security-Policy-Report-Only;
|