From c936c99fad7e090a3caaaa6bdd5fbaf38d39abba Mon Sep 17 00:00:00 2001
From: Alan Pearce
Date: Mon, 11 Sep 2023 17:56:22 +0200
Subject: Improve CSP setup

---
 Caddyfile   | 2 +-
 config.toml | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/Caddyfile b/Caddyfile
index d234c87..c779358 100644
--- a/Caddyfile
+++ b/Caddyfile
@@ -55,7 +55,7 @@ http://alanpearce.eu {
 		Cache-Control max-age=14400
 		X-Content-Type-Options nosniff
 		Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
-		Content-Security-Policy "default-src 'none'; img-src 'self'; object-src 'none'; script-src 'none'; style-src 'unsafe-inline'"
+		Content-Security-Policy "default-src 'none'; img-src 'self'; object-src 'none'; script-src 'none'; style-src 'unsafe-inline'; form-action 'none'; base-uri 'self'"
 	}
 	handle_errors {
 		@404 expression `{err.status_code} == 404`
diff --git a/config.toml b/config.toml
index 55e8931..c3377d5 100644
--- a/config.toml
+++ b/config.toml
@@ -23,6 +23,7 @@ author_name = "Alan Pearce"
 author_image = "/img/me-thumb.jpg"
 hide_made_with_line = true
 date_format = "%F"
+webserver_sends_csp_headers = true
 
 [[extra.main_menu]]
     name = "Posts"
-- 
cgit 1.4.1