marco.morath/einkaufsapp
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Ergänzung Datenschutzerklärung und Impressum, Fristenformular in Einstellungen

Browse Source
This commit is contained in:
Marco Morath
2026-08-10 06:44:11 +02:00
parent 8ffbda875e
commit 777e3e5447
25 changed files with 1310 additions and 139 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
web/security_headers.conf
View File

@@ -10,4 +10,7 @@ add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "DENY" always;
add_header Referrer-Policy "no-referrer" always;
add_header Permissions-Policy "camera=(self), geolocation=(), microphone=()" always;
add_header Content-Security-Policy "default-src 'self'; img-src 'self' data: blob:; style-src 'self'; script-src 'self'; connect-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'" always;
# font-src 'self' steht ausdrücklich da, obwohl default-src es schon
# abdeckt: Es soll beim Lesen der Datei erkennbar sein, dass keine
# Schriften von fremden Servern nachgeladen werden dürfen.
add_header Content-Security-Policy "default-src 'self'; img-src 'self' data: blob:; style-src 'self'; script-src 'self'; font-src 'self'; connect-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'" always;