vbatts/microblog.pub
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

csp: support old browsers without style-src-attr

Browse source
This commit is contained in:
hiromi-mi 2020-06-20 09:50:32 +09:00
parent 58a14c4ab0
commit f0929c6bab
1 changed files with 4 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

7
app.py
View file

@ -101,14 +101,15 @@ csrf.init_app(app)
csp = {
"default-src": "'self'",
"style-src-attr": "'unsafe-inline'",
"script-src": "'self'", # to use nonce
"style-src": "'self'", # to use nonce
"script-src": "'self'", # to use nonce
"style-src": "'unsafe-inline'", # for old browsers without support style-src-attr
"style-src-elem": "'self'",
}
talisman = Talisman(
app,
content_security_policy=csp,
force_https=False, # internal requests like /tasks/* are sent over HTTP
force_https=False, # internal requests like /tasks/* are sent over HTTP
content_security_policy_nonce_in=["script-src", "style-src"],
)