mirror of
https://github.com/penpot/penpot.git
synced 2026-09-01 17:49:08 +00:00
a8ccb5e0cd
Ship both headers from the image so that every deployment starts from a sensible default instead of each installation deriving its own policy. Report-only mode never blocks a request, so this changes no behaviour for existing deployments, and HSTS stays absent unless PENPOT_PUBLIC_URI declares an https scheme. The policy can be narrow because the frontend already reverse proxies its own external dependencies, so 'self' covers them. What it must permit beyond that comes from the code: 'wasm-unsafe-eval' for the render engine, 'unsafe-inline' styles for the inline style attributes of the UI, and blob:/data: for thumbnails, exports and fonts. Closes #11374 Signed-off-by: David Barragán Merino <david.barragan@kaleidos.net> AI-assisted-by: Claude