From 0d76342ec78d3eb029235bef4c7c7fd201dcadd2 Mon Sep 17 00:00:00 2001
From: Jieiku
Date: Mon, 16 May 2022 06:48:55 -0700
Subject: Make Security Headers Configurable
---
config.toml | 15 ++++++++++-----
templates/macros/head.html | 8 +++++---
2 files changed, 15 insertions(+), 8 deletions(-)
diff --git a/config.toml b/config.toml
index 4aa6e1c..7b29142 100644
--- a/config.toml
+++ b/config.toml
@@ -39,11 +39,6 @@ recent_items = 9
footer_credit = true
#footer_credit_override = 'Powered by Zola & Abridge
' #
-# Security Headers should preferably be set by your webserver (Nginx, Apache) https://observatory.mozilla.org
-# Set this to true if you are unable to load your security headers with your webserver, this will load a couple of them as meta tags.
-# There are many other security related headers most of which can only be set by the webserver method.
-security_headers = false
-
textlogo = 'Abridge'
sitedesc = false # enables or disables the display of the site description below the logo.
#copyright_start_year = 2019 # optional
@@ -63,6 +58,16 @@ menu_footer = [
{url = "/sitemap.xml", name = "Sitemap", slash = false},
]
+# Security Headers should preferably be set by your webserver (Nginx, Apache) https://observatory.mozilla.org
+# If you are unable to load your security headers with your webserver, this will load a couple of them as meta tags.
+# There are many other security related headers most of which can only be set by the webserver method.
+# Comment out either of these meta headers and they wont be used.
+
+security_header_referrer = "strict-origin-when-cross-origin"
+
+security_header_csp = "default-src 'none'; frame-ancestors 'none'; base-uri 'self'; manifest-src 'self'; connect-src 'self'; form-action 'self'; font-src 'self' cdn.jsdelivr.net fonts.gstatic.com; style-src 'self' cdn.jsdelivr.net fonts.googleapis.com; object-src 'self'; frame-src 'self' *.youtube.com; img-src 'self' data: cdn.cloudflare.com; script-src 'self' 'unsafe-inline' *.youtube.com maps.gstatic.com *.googleapis.com *.google-analytics.com cdnjs.cloudflare.com"
+
+
#################
# Resource Files
diff --git a/templates/macros/head.html b/templates/macros/head.html
index 2c18807..6736cd9 100644
--- a/templates/macros/head.html
+++ b/templates/macros/head.html
@@ -195,9 +195,11 @@
{%- endmacro %}
{%- macro security() %}
- {%- if config.extra.security_headers %}
- {#- options: no-referrer, same-origin, strict-origin, strict-origin-when-cross-origin #}
-
+ {%- if config.extra.security_header_referrer %}
+
+ {%- endif %}
+ {%- if config.extra.security_header_csp %}
+
{%- endif %}
{%- endmacro %}
--
cgit v1.3.1