forked from web/portal
6 lines
358 B
ApacheConf
6 lines
358 B
ApacheConf
# CSP Starter Policy: allows images, scripts, AJAX, and CSS from the same origin, and does not allow any other resources to load (eg object, frame, media, etc).
|
|
Header set Content-Security-Policy "default-src 'none'; script-src 'self'; connect-src 'self'; img-src 'self'; style-src 'self';"
|
|
|
|
# Referrer Policy
|
|
Header always set Referrer-Policy "no-referrer"
|