diff options
| author | Gab Virebent <gabriel1@virebent.art> | 2026-07-08 23:54:25 +0200 |
|---|---|---|
| committer | Gab Virebent <gabriel1@virebent.art> | 2026-07-08 23:54:25 +0200 |
| commit | f21e4d8781c06c0686f4a8697ce0697f9bf6a5cc (patch) | |
| tree | 36ff93976b004f3da5ba8490d6357d3369569a52 /internal/handler/static.go | |
| parent | b3d7132714f35174cef0cf5d96bed02a1c4ddff4 (diff) | |
| download | nymdrop-f21e4d8781c06c0686f4a8697ce0697f9bf6a5cc.tar.gz nymdrop-f21e4d8781c06c0686f4a8697ce0697f9bf6a5cc.tar.xz nymdrop-f21e4d8781c06c0686f4a8697ce0697f9bf6a5cc.zip | |
Add Nym community favicon and allow img-src in CSP
favicon.ico/32/48 reference the official Nym icon so the site is
recognizable as Nym-community. CSP img-src 'self' data: was needed
for the PNG variants to load under the strict script-src 'self' policy.
Diffstat (limited to 'internal/handler/static.go')
| -rw-r--r-- | internal/handler/static.go | 3 |
1 files changed, 1 insertions, 2 deletions
diff --git a/internal/handler/static.go b/internal/handler/static.go index bf2aaec..8e87172 100644 --- a/internal/handler/static.go +++ b/internal/handler/static.go @@ -7,8 +7,7 @@ import ( func Static(dir string) http.Handler { fs := http.FileServer(http.Dir(dir)) return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { - // Security headers on every response. - w.Header().Set("Content-Security-Policy", "default-src 'self'; script-src 'self'; style-src 'self'") + w.Header().Set("Content-Security-Policy", "default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; connect-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'") w.Header().Set("X-Content-Type-Options", "nosniff") w.Header().Set("Referrer-Policy", "no-referrer") w.Header().Set("Permissions-Policy", "geolocation=(), microphone=(), camera=()") |