nobswebdev/private_image
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add CSP sandbox on nginx hotlink image responses.

Browse Source 
Block script in user content when /i/ is opened as a document, e.g. SVG opened in a tab.
This commit is contained in:
nobswebdev
2026-10-28 22:38:28 +01:00
parent 4a534a8007
commit b97fcc2b20
1 changed files with 1 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
nginx/snippets/private-image-locations.conf.template
+1
View File
@@ -1,4 +1,5 @@
location ^~ /i/ { location ^~ /i/ {
add_header Content-Security-Policy "sandbox" always;
add_header X-Content-Type-Options "nosniff" always; add_header X-Content-Type-Options "nosniff" always;
add_header Cross-Origin-Resource-Policy "cross-origin" always; add_header Cross-Origin-Resource-Policy "cross-origin" always;
add_header Cache-Control "private, no-store" always; add_header Cache-Control "private, no-store" always;