Add comment to explain why unsafe-inline is needed

Co-authored-by: Richard van der Hoff <1389908+richvdh@users.noreply.github.com>
pull/2226/head
Johannes Marbach 1 month ago committed by GitHub
parent e179fd4546
commit cea4844b22
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194

@ -127,6 +127,8 @@ sidebar_menu_compact = true
[[server.headers]]
for = '/**'
[server.headers.values]
# `style-src 'unsafe-inline'` is needed to correctly render the maths in the Olm spec:
# https://github.com/KaTeX/KaTeX/issues/4096
Content-Security-Policy = "default-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self'; img-src 'self' data:; connect-src 'self'; font-src 'self' data:; media-src 'self'; child-src 'self'; form-action 'self'; object-src 'self'"
X-XSS-Protection = "1; mode=block"
X-Content-Type-Options = "nosniff"

Loading…
Cancel
Save