add csp rules

crazyguitar · Sep 13, 2018 · ce253de · ce253de
1 parent 02348c3
commit ce253de
Showing 1 changed file with 5 additions and 1 deletion.
diff --git a/app.py b/app.py
@@ -22,16 +22,20 @@ def find_key(token):
 
 
 csp = {
-    "default-src": ["'self'", "github.com", "*.readthedocs.org"],
+    "default-src": "'none'",
     "style-src": ["'self'", "unsafe-inline", "'unsafe-inline'"],
     "script-src": [
         "'self'",
         "*.cloudflare.com",
         "'unsafe-inline'",
         "'unsafe-eval'",
     ],
+    "form-action": "'self'",
+    "base-uri": "'self'",
     "img-src": "*",
     "frame-src": "ghbtns.com",
+    "frame-ancestors": "'none'",
+    "object-src": "'none'",
 }
 app = Flask(__name__)
 app.config["SECRET_KEY"] = os.urandom(16)