From b97fcc2b20d3d66e0daab7d9ebcaf3aba68c1f70 Mon Sep 17 00:00:00 2001 From: nobswebdev Date: Wed, 28 Oct 2026 22:38:28 +0100 Subject: [PATCH] Add CSP sandbox on nginx hotlink image responses. Block script in user content when /i/ is opened as a document, e.g. SVG opened in a tab. --- nginx/snippets/private-image-locations.conf.template | 1 + 1 file changed, 1 insertion(+) diff --git a/nginx/snippets/private-image-locations.conf.template b/nginx/snippets/private-image-locations.conf.template index c8611ec..8abbb6b 100644 --- a/nginx/snippets/private-image-locations.conf.template +++ b/nginx/snippets/private-image-locations.conf.template @@ -1,4 +1,5 @@ location ^~ /i/ { + add_header Content-Security-Policy "sandbox" always; add_header X-Content-Type-Options "nosniff" always; add_header Cross-Origin-Resource-Policy "cross-origin" always; add_header Cache-Control "private, no-store" always;