diff options
| author | kaniini <nenolod@gmail.com> | 2019-02-12 22:41:46 +0000 |
|---|---|---|
| committer | kaniini <nenolod@gmail.com> | 2019-02-12 22:41:46 +0000 |
| commit | 0534463cef059d1af1e90007e13e27207876dd9f (patch) | |
| tree | a7bcf49690e6871599d3f26c0448a206359263e0 | |
| parent | c71b3a1b124f5dba23ebe812289868aa4983d8a8 (diff) | |
| parent | da4c662af31a2c45c767f2a9ed136272ee9fc2c8 (diff) | |
| download | pleroma-0534463cef059d1af1e90007e13e27207876dd9f.tar.gz | |
Merge branch 'feature/csp_mastofe-dev' into 'develop'
Add CSP for mastofe development, remove secure-cookies in MIX_ENV=dev
See merge request pleroma/pleroma!820
| -rw-r--r-- | config/dev.exs | 3 | ||||
| -rw-r--r-- | lib/pleroma/plugs/http_security_plug.ex | 19 |
2 files changed, 19 insertions, 3 deletions
diff --git a/config/dev.exs b/config/dev.exs index 8f89aa03c..f77bb9976 100644 --- a/config/dev.exs +++ b/config/dev.exs @@ -16,7 +16,8 @@ config :pleroma, Pleroma.Web.Endpoint, debug_errors: true, code_reloader: true, check_origin: false, - watchers: [] + watchers: [], + secure_cookie_flag: false config :pleroma, Pleroma.Mailer, adapter: Swoosh.Adapters.Local diff --git a/lib/pleroma/plugs/http_security_plug.ex b/lib/pleroma/plugs/http_security_plug.ex index 3c8e6a18f..057553e24 100644 --- a/lib/pleroma/plugs/http_security_plug.ex +++ b/lib/pleroma/plugs/http_security_plug.ex @@ -34,6 +34,21 @@ defmodule Pleroma.Plugs.HTTPSecurityPlug do defp csp_string do scheme = Config.get([Pleroma.Web.Endpoint, :url])[:scheme] + websocket_url = String.replace(Pleroma.Web.Endpoint.static_url(), "http", "ws") + + connect_src = + if Mix.env() == :dev do + "connect-src 'self' http://localhost:3035/ " <> websocket_url + else + "connect-src 'self' " <> websocket_url + end + + script_src = + if Mix.env() == :dev do + "script-src 'self' 'unsafe-eval'" + else + "script-src 'self'" + end [ "default-src 'none'", @@ -43,9 +58,9 @@ defmodule Pleroma.Plugs.HTTPSecurityPlug do "media-src 'self' https:", "style-src 'self' 'unsafe-inline'", "font-src 'self'", - "script-src 'self'", - "connect-src 'self' " <> String.replace(Pleroma.Web.Endpoint.static_url(), "http", "ws"), "manifest-src 'self'", + connect_src, + script_src, if scheme == "https" do "upgrade-insecure-requests" end |