feat: add default Content-Security-Policy header to middleware

2025-09-06 09:44:17 -04:00
parent 07a63cd6d7
commit ee6034b752
1 changed files with 9 additions and 0 deletions
--- a/src/middleware/mod.rs
+++ b/src/middleware/mod.rs
@@ -126,6 +126,15 @@ where
                );
            }

+            if !headers.contains_key(actix_web::http::header::CONTENT_SECURITY_POLICY) {
+                let _ = headers.insert(
+                    actix_web::http::header::CONTENT_SECURITY_POLICY,
+                    actix_web::http::header::HeaderValue::from_static(
+                        "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self'; frame-ancestors 'none'"
+                    ),
+                );
+            }
+
            Ok(res)
        })
    }