Add CSP sandbox on nginx hotlink image responses.

Block script in user content when /i/ is opened as a document, e.g. SVG opened in a tab.
2026-10-28 22:38:28 +01:00
parent 4a534a8007
commit b97fcc2b20
1 changed files with 1 additions and 0 deletions
@@ -1,4 +1,5 @@
 location ^~ /i/ {
+    add_header Content-Security-Policy "sandbox" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header Cross-Origin-Resource-Policy "cross-origin" always;
    add_header Cache-Control "private, no-store" always;