diff --git a/nginx.conf b/nginx.conf index abf8c59e1..63e284a14 100644 --- a/nginx.conf +++ b/nginx.conf @@ -58,8 +58,8 @@ http { root /usr/share/nginx/dist; add_header Cache-Control "no-cache"; # At the moment we need the "connect-src 'self' data:"" entry in order to use PNG images as data format - # add_header Content-Security-Policy "default-src 'self'; connect-src 'self' data:; style-src 'self' 'unsafe-inline' https://cdn.eds.equinor.com; script-src 'self' 'unsafe-eval' blob:; font-src https://cdn.eds.equinor.com; img-src 'self' data:; form-action 'self'; base-uri 'none'; frame-ancestors 'none';"; - add_header Content-Security-Policy "default-src 'self'; style-src 'self' 'unsafe-inline' https://cdn.eds.equinor.com; script-src 'self' 'unsafe-eval' blob:; font-src https://cdn.eds.equinor.com; img-src 'self' data:; form-action 'self'; base-uri 'none'; frame-ancestors 'none';"; + add_header Content-Security-Policy "default-src 'self'; connect-src 'self' data:; style-src 'self' 'unsafe-inline' https://cdn.eds.equinor.com; script-src 'self' 'unsafe-eval' blob:; font-src https://cdn.eds.equinor.com; img-src 'self' data:; form-action 'self'; base-uri 'none'; frame-ancestors 'none';"; + # add_header Content-Security-Policy "default-src 'self'; style-src 'self' 'unsafe-inline' https://cdn.eds.equinor.com; script-src 'self' 'unsafe-eval' blob:; font-src https://cdn.eds.equinor.com; img-src 'self' data:; form-action 'self'; base-uri 'none'; frame-ancestors 'none';"; add_header X-Content-Type-Options "nosniff"; add_header X-Frame-Options "DENY"; add_header X-XSS-Protection "1; mode=block";