safeweb: allow object-src: self in CSP (#11782)

This change is safe (self is still safe, by definition), and makes the code match the comment. Updates #cleanup Signed-off-by: Chris Palmer <cpalmer@tailscale.com>
2 weeks ago · bdfaef4879
parent e775de3c63
commit bdfaef4879
1 changed files with 1 additions and 1 deletions
--- a/safeweb/http.go
+++ b/safeweb/http.go
@ -89,7 +89,7 @@ var defaultCSP = strings.Join([]string{
 	`form-action 'self'`,      // disallow form submissions to other origins
 	`base-uri 'self'`,         // disallow base URIs from other origins
 	`block-all-mixed-content`, // disallow mixed content when serving over HTTPS
-	`object-src 'none'`,       // disallow embedding of resources from other origins
+	`object-src 'self'`,       // disallow embedding of resources from other origins
 }, "; ")

 // Config contains the configuration for a safeweb server.