penpot/nginx-security-headers.conf.template at a8ccb5e0cdcac027c59f1d88907763d44d5ba17a - penpot - Gitea: 鑫胜代码平台

github/penpot

mirror of https://github.com/penpot/penpot.git synced 2026-09-01 17:49:08 +00:00

David Barragán Merino a8ccb5e0cd 🐳 Add configurable CSP and HSTS headers to the frontend image

Ship both headers from the image so that every deployment starts from a sensible default instead of each installation deriving its own policy. Report-only mode never blocks a request, so this changes no behaviour for existing deployments, and HSTS stays absent unless PENPOT_PUBLIC_URI declares an https scheme.

The policy can be narrow because the frontend already reverse proxies its own external dependencies, so 'self' covers them. What it must permit beyond that comes from the code: 'wasm-unsafe-eval' for the render engine, 'unsafe-inline' styles for the inline style attributes of the UI, and blob:/data: for thumbnails, exports and fonts.

Closes #11374
Signed-off-by: David Barragán Merino <david.barragan@kaleidos.net>
AI-assisted-by: Claude

2026-09-01 16:13:04 +02:00

7 lines

297 B

Plaintext

Raw Blame History

 add_header X-Content-Type-Options "nosniff" always;
 add_header Referrer-Policy "strict-origin-when-cross-origin" always;
 add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
 add_header X-Frame-Options SAMEORIGIN always;
 ${PENPOT_CSP_DIRECTIVE}
 ${PENPOT_HSTS_DIRECTIVE}