From 76ed711f895768f268edb9bff28514bd7acb38b5 Mon Sep 17 00:00:00 2001 From: Daniel James Smith Date: Sat, 21 Jan 2023 02:12:56 +0100 Subject: [PATCH] Remove gravatar.com from CSP rules (#2526) --- docker-unified/hbs/nginx-config.hbs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docker-unified/hbs/nginx-config.hbs b/docker-unified/hbs/nginx-config.hbs index 81dd85b34a..d405bf5ac9 100644 --- a/docker-unified/hbs/nginx-config.hbs +++ b/docker-unified/hbs/nginx-config.hbs @@ -57,7 +57,7 @@ server { include /etc/nginx/security-headers-ssl.conf; {{/if}} include /etc/nginx/security-headers.conf; - add_header Content-Security-Policy "{{{String.Coalesce env.BW_CSP "default-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https://haveibeenpwned.com https://www.gravatar.com; child-src 'self' https://*.duosecurity.com https://*.duofederal.com; frame-src 'self' https://*.duosecurity.com https://*.duofederal.com; connect-src 'self' https://api.pwnedpasswords.com https://api.2fa.directory; object-src 'self' blob:;"}}}"; + add_header Content-Security-Policy "{{{String.Coalesce env.BW_CSP "default-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https://haveibeenpwned.com; child-src 'self' https://*.duosecurity.com https://*.duofederal.com; frame-src 'self' https://*.duosecurity.com https://*.duofederal.com; connect-src 'self' https://api.pwnedpasswords.com https://api.2fa.directory; object-src 'self' blob:;"}}}"; add_header X-Frame-Options SAMEORIGIN; add_header X-Robots-Tag "noindex, nofollow"; }